@fedify/fedify 2.2.0-dev.933 → 2.2.0-dev.938

package/dist/sig/proof.test.mjs

@@ -2,15 +2,15 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-CRDpx_HF.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as normalizePublicAudience } from "../public-audience-eovWqzOF.mjs";
-import { a as verifyProof, i as verifyObject, n as hasProofLike, r as signObject, t as createProof } from "../proof-Bv96WRg6.mjs";
+import { t as assert } from "../assert-DikXweDx.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DGu1NFwu.mjs";
+import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-CNmZLixq.mjs";
+import { a as verifyProof, i as verifyObject, n as hasProofLike, r as signObject, t as createProof } from "../proof-B9ynOKyy.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import { Create, DataIntegrityProof, Multikey, Note, PUBLIC_COLLECTION, Place } from "@fedify/vocab";
+import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place } from "@fedify/vocab";
 import { decodeMultibase, importMultibaseKey } from "@fedify/vocab-runtime";
 import { decodeHex } from "byte-encodings/hex";
 //#region src/sig/proof.test.ts
@@ -158,7 +158,11 @@ test("signObject()", async () => {
 		object: new Note({
 			id: new URL("https://server.example/objects/2"),
 			attribution: new URL("https://server.example/users/alice"),
-			content: "Hello public"
+			content: "Hello public",
+			attachments: [new Document({
+				mediaType: "image/png",
+				url: new URL("https://server.example/objects/2/image.png")
+			})]
 		}),
 		tos: [PUBLIC_COLLECTION]
 	}), fep8b32TestVectorPrivateKey, fep8b32TestVectorKeyId, {
@@ -167,8 +171,10 @@ test("signObject()", async () => {
 	});
 	const [proof] = await Array.fromAsync(signed.getProofs(options));
 	assertInstanceOf(proof, DataIntegrityProof);
-	const signedJson = await normalizePublicAudience(await signed.toJsonLd(options), mockDocumentLoader);
+	const signedJson = await normalizeOutgoingActivityJsonLd(await signed.toJsonLd(options), mockDocumentLoader);
 	assertEquals(signedJson.to, PUBLIC_COLLECTION.href);
+	const signedJsonObject = signedJson.object;
+	assertEquals(Array.isArray(signedJsonObject.attachment), true);
 	const verifyCache = {};
 	const verifyOptions = {
 		contextLoader: mockDocumentLoader,
@@ -184,6 +190,8 @@ test("signObject()", async () => {
 	assertInstanceOf(await verifyProof(signedJson, proof, verifyOptions), Multikey);
 	const signedJsonWithCurie = await signed.toJsonLd(options);
 	assertEquals(signedJsonWithCurie.to, "as:Public");
+	const signedJsonWithCurieObject = signedJsonWithCurie.object;
+	assertEquals(Array.isArray(signedJsonWithCurieObject.attachment), false);
 	assertInstanceOf(await verifyProof(signedJsonWithCurie, proof, verifyOptions), Multikey);
 });
 test("hasProofLike()", () => {
@@ -294,7 +302,7 @@ test("verifyProof()", async () => {
 		}
 	}, proof, options), expectedKey);
 	assertEquals(await verifyProof([jsonLd], proof, options), null);
-	assertEquals(await verifyProof({
+	const attackerInput = {
 		"@context": ["https://www.w3.org/ns/activitystreams", "https://attacker.example/ctx"],
 		id: "https://server.example/activities/attacker",
 		type: "Create",
@@ -306,10 +314,17 @@ test("verifyProof()", async () => {
 			content: "n/a",
 			to: "as:Public"
 		}
-	}, proof, {
+	};
+	const contextLoaderCalls = [];
+	assertEquals(await verifyProof(attackerInput, proof, {
+		contextLoader: async (url) => {
+			contextLoaderCalls.push(url);
+			return await mockDocumentLoader(url);
+		},
 		documentLoader: mockDocumentLoader,
 		keyCache: options.keyCache
 	}), null);
+	assertFalse(contextLoaderCalls.includes("https://attacker.example/ctx"));
 });
 test("verifyObject()", async () => {
 	const options = {

package/dist/{std__assert-Duiq_YC9.mjs → std__assert-CRDpx_HF.mjs}

@@ -1,9 +1,10 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { a as red, i as buildMessage, l as AssertionError, n as diffStr, r as diff, s as format } from "./assert_equals-Ew3jOFa3.mjs";
+import { l as AssertionError, s as format } from "./assert_equals-Ew3jOFa3.mjs";
 import "./assert_rejects-B-qJtC9Z.mjs";
 import "./assert_throws-4NwKEy2q.mjs";
+import "./assert_strict_equals-Dmjbg-bA.mjs";
 //#region ../../node_modules/.pnpm/@jsr+std__assert@0.226.0/node_modules/@jsr/std__assert/assert_exists.js
 /**
 * Make an assertion that actual is not null or undefined.
@@ -77,42 +78,6 @@ import "./assert_throws-4NwKEy2q.mjs";
 	throw new AssertionError(msg ?? `Expect ${actualString} > ${expectedString}`);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@jsr+std__assert@0.226.0/node_modules/@jsr/std__assert/assert_strict_equals.js
-/**
-* Make an assertion that `actual` and `expected` are equal using
-* {@linkcode Object.is} for equality comparison. If not, then throw.
-*
-* @example Usage
-* ```ts no-eval
-* import { assertStrictEquals } from "@std/assert/assert-strict-equals";
-*
-* const a = {};
-* const b = a;
-* assertStrictEquals(a, b); // Doesn't throw
-*
-* const c = {};
-* const d = {};
-* assertStrictEquals(c, d); // Throws
-* ```
-*
-* @typeParam T The type of the expected value.
-* @param actual The actual value to compare.
-* @param expected The expected value to compare.
-* @param msg The optional message to display if the assertion fails.
-*/ function assertStrictEquals(actual, expected, msg) {
-	if (Object.is(actual, expected)) return;
-	const msgSuffix = msg ? `: ${msg}` : ".";
-	let message;
-	const actualString = format(actual);
-	const expectedString = format(expected);
-	if (actualString === expectedString) message = `Values have the same structure but are not reference-equal${msgSuffix}\n\n${red(actualString.split("\n").map((l) => `    ${l}`).join("\n"))}\n`;
-	else {
-		const stringDiff = typeof actual === "string" && typeof expected === "string";
-		message = `Values are not strictly equal${msgSuffix}\n${buildMessage(stringDiff ? diffStr(actual, expected) : diff(actualString.split("\n"), expectedString.split("\n")), { stringDiff }).join("\n")}`;
-	}
-	throw new AssertionError(message);
-}
-//#endregion
 //#region ../../node_modules/.pnpm/@jsr+std__assert@0.226.0/node_modules/@jsr/std__assert/assert_string_includes.js
 /**
 * Make an assertion that actual includes expected. If not
@@ -136,4 +101,4 @@ import "./assert_throws-4NwKEy2q.mjs";
 	}
 }
 //#endregion
-export { assertExists as a, assertGreaterOrEqual as i, assertStrictEquals as n, assertGreater as r, assertStringIncludes as t };
+export { assertExists as i, assertGreater as n, assertGreaterOrEqual as r, assertStringIncludes as t };

package/dist/testing/mod.d.mts

@@ -584,6 +584,15 @@ interface FanoutMessage {
   readonly activityType: string;
   readonly collectionSync?: string;
   readonly orderingKey?: string;
+  /**
+   * Whether to apply outgoing JSON-LD wire-format normalization to queued
+   * activities that already carry Object Integrity Proofs.
+   *
+   * `true` is used for proofs Fedify created before fanout, or when callers
+   * explicitly request normalization for locally pre-signed activities.
+   * `false`/`undefined` preserves existing proofs as-is.
+   */
+  readonly normalizeExistingProofs?: boolean;
   readonly traceContext: Readonly<Record<string, string>>;
 }
 interface OutboxMessage {
@@ -2215,6 +2224,19 @@ interface SendActivityOptions {
    * @since 1.5.0
    */
   readonly fanout?: "auto" | "skip" | "force";
+  /**
+   * Whether to apply Fedify's outgoing JSON-LD wire-format compatibility fixes
+   * to activities that already carry Object Integrity Proofs.
+   *
+   * By default, Fedify preserves existing proofs byte-for-byte because it
+   * cannot know whether they were created for the normalized outgoing wire
+   * form.  Set this to `true` when sending an activity that was pre-signed
+   * locally with `signObject()` or `createProof()`, so the emitted
+   * compact JSON-LD matches the bytes covered by the proof.
+   *
+   * @since 2.2.0
+   */
+  readonly normalizeExistingProofs?: boolean;
   /**
    * The base URIs to exclude from the recipients' inboxes.  It is useful
    * for excluding the recipients having the same shared inbox with the sender.

package/dist/utils/docloader.test.mjs

@@ -3,11 +3,11 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-CRDpx_HF.mjs";
 import { t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { l as verifyRequest } from "../http-DAbItDan.mjs";
-import { i as rsaPrivateKey2 } from "../keys-BAK-tUlf.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-DKJ5e8gU.mjs";
+import { l as verifyRequest } from "../http-pO-cqL07.mjs";
+import { i as rsaPrivateKey2 } from "../keys-DGu1NFwu.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-C5hOIM67.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { UrlError } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.test.ts

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-B01V7s3h.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-U__xU4qR.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, throws } from "node:assert";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,6 +1,6 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-CuhV7I2P.cjs");
+const require_kv_cache = require("../kv-cache-BM50uOpt.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BGV0-93s.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-D7IdkIte.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.2.0-dev.933+2ba4d27a",
+  "version": "2.2.0-dev.938+94d98c0c",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -153,9 +153,9 @@
     "uri-template-router": "^1.0.0",
     "url-template": "^3.1.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/vocab-runtime": "2.2.0-dev.933+2ba4d27a",
-    "@fedify/vocab": "2.2.0-dev.933+2ba4d27a",
-    "@fedify/webfinger": "2.2.0-dev.933+2ba4d27a"
+    "@fedify/vocab": "2.2.0-dev.938+94d98c0c",
+    "@fedify/vocab-runtime": "2.2.0-dev.938+94d98c0c",
+    "@fedify/webfinger": "2.2.0-dev.938+94d98c0c"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -168,7 +168,7 @@
     "typescript": "^5.9.2",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.2.0-dev.933+2ba4d27a"
+    "@fedify/vocab-tools": "^2.2.0-dev.938+94d98c0c"
   },
   "scripts": {
     "build:self": "tsdown",