Add FEP-f799 vocabulary and raw shape tools

.agents/skills/add-vocab/SKILL.md

@@ -329,15 +329,26 @@ Range type reference
 
 ### Fedify internal types
 
-| Range URI             | TypeScript type                                        | Notes                               |
-| --------------------- | ------------------------------------------------------ | ----------------------------------- |
-| `fedify:langTag`      | `Intl.Locale`                                          | BCP 47 language tag as plain string |
-| `fedify:url`          | `URL`                                                  | URL stored as `@value` (not `@id`)  |
-| `fedify:absoluteIri`  | `URL`                                                  | Absolute IRI stored as `@id`; also reads literals, never resolves relative values |
-| `fedify:publicKey`    | `CryptoKey`                                            | PEM SPKI-encoded public key         |
-| `fedify:multibaseKey` | `CryptoKey`                                            | Multibase-encoded key (Ed25519)     |
-| `fedify:proofPurpose` | `"assertionMethod" \| "authentication" \| ...`         | Proof purpose string                |
-| `fedify:units`        | `"cm" \| "feet" \| "inches" \| "km" \| "m" \| "miles"` | Place units                         |
+| Range URI                    | TypeScript type                                        | Notes                                                                                                           |
+| ---------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- |
+| `fedify:typedString`         | `string`                                               | Explicit `xsd:string` output; accepts plain or `xsd:string` string literals, skips incompatible incoming values |
+| `fedify:positiveSafeInteger` | `number`                                               | Explicit `xsd:integer` output; accepts only positive safe numeric integers, skips incompatible incoming values  |
+| `fedify:langTag`             | `Intl.Locale`                                          | BCP 47 language tag as plain string                                                                             |
+| `fedify:url`                 | `URL`                                                  | URL stored as `@value` (not `@id`)                                                                              |
+| `fedify:absoluteIri`         | `URL`                                                  | Absolute IRI stored as `@id`; also reads literals, never resolves relative values                               |
+| `fedify:publicKey`           | `CryptoKey`                                            | PEM SPKI-encoded public key                                                                                     |
+| `fedify:multibaseKey`        | `CryptoKey`                                            | Multibase-encoded key (Ed25519)                                                                                 |
+| `fedify:proofPurpose`        | `"assertionMethod" \| "authentication" \| ...`         | Proof purpose string                                                                                            |
+| `fedify:units`               | `"cm" \| "feet" \| "inches" \| "km" \| "m" \| "miles"` | Place units                                                                                                     |
+
+Use `fedify:typedString` when a context coerces a term to `xsd:string`, so the
+serializer emits the compact term instead of a full property IRI.  Use
+`fedify:positiveSafeInteger` for protocol fields whose numeric range is
+1–9007199254740991.  These are targeted codecs; the existing `xsd:string` and
+`xsd:integer` codecs retain their behavior.  Lenient incoming decoding does not
+validate protocol shape or multiplicity; inspect the original JSON-LD
+separately when those facts matter.  Raw-property writes remain strict and
+reject unsupported values instead of skipping them.
 
 ### Vocabulary types
 

CHANGES.md

@@ -70,6 +70,25 @@ To be released.
     breaking source compatibility for custom implementations. Update custom
     mocks, decorators, and wrappers to implement this method.
     [[#1316], [#1359] by Jiwon Kwon\]
+ -  Added raw [FEP-f799] shape tools in
+    `@fedify/fedify/delivery-suspension`.  The asynchronous notice, activity,
+    actor metadata, and inbox metadata parsers preserve expanded IRI spelling,
+    literal values, and multiplicity, and return detached evidence and
+    diagnostics.  Diagnostic `path` values refer to original expanded evidence
+    after expansion succeeds; earlier failures may use input or context
+    pointers. Dropped occurrences retain their original JSON pointer in
+    `rawPath`. Unrelated embedded objects are classified before requiring
+    control-activity fields.  The default loader resolves preloaded contexts
+    locally; applications can explicitly supply a context loader. A
+    conservative context preflight reserves work for both expansions before
+    processing, and marker selection has a fixed collision limit. The parsers
+    reject expanded `@included` outside `@value` literals, and repeated
+    descriptions of an inspected `@id` even when they occur in different named
+    graphs. Reverse assertions about inspected IDs are rejected as well. Strict
+    HTTPS origin helpers validate origin spelling before URL normalization,
+    including IDNA2008 validation against a pinned Unicode 12.0 repertoire.
+    These tools expose unverified claims; they do not authenticate notices,
+    establish controller authority, or suspend delivery. [[#1369], [#1435]]
  -  Added sender payload projection support for the published FEP-171b context,
     preserving blind-recipient redaction.
     [[#1250], [#1396] by Jiwon Kwon\]
@@ -107,6 +126,7 @@ To be released.
     [[#1030], [#1205] by Yujin Jung\]
 
 [FEP-7aa9]: https://w3id.org/fep/7aa9
+[FEP-f799]: https://w3id.org/fep/f799
 [GHSA-4qhx-hhwf-8685]: https://github.com/fedify-dev/fedify/security/advisories/GHSA-4qhx-hhwf-8685
 [#1030]: https://github.com/fedify-dev/fedify/issues/1030
 [#1177]: https://github.com/fedify-dev/fedify/issues/1177
@@ -124,10 +144,12 @@ To be released.
 [#1359]: https://github.com/fedify-dev/fedify/pull/1359
 [#1361]: https://github.com/fedify-dev/fedify/issues/1361
 [#1363]: https://github.com/fedify-dev/fedify/issues/1363
+[#1369]: https://github.com/fedify-dev/fedify/issues/1369
 [#1382]: https://github.com/fedify-dev/fedify/issues/1382
 [#1395]: https://github.com/fedify-dev/fedify/pull/1395
 [#1396]: https://github.com/fedify-dev/fedify/pull/1396
 [#1415]: https://github.com/fedify-dev/fedify/pull/1415
+[#1435]: https://github.com/fedify-dev/fedify/pull/1435
 
 ### @fedify/backfill
 
@@ -482,6 +504,18 @@ To be released.
     Mastodon reads when it refreshes an account, and parsing accepts both
     a single string value and an array of strings.  [[#1234], [#1353]]
 
+ -  Added the draft [FEP-f799] `DeliverySuspension` vocabulary type,
+    `Collection.deliveryController`, and `controlledOrigins` on all five
+    actor classes.  The TypeScript `suspensionStatus` accessor preserves the
+    FEP's `status` wire term without merging unrelated status properties.
+    Origin strings retain their spelling, and inbox/controller links are
+    URL-valued without fetching resources.  These additions do not enable
+    handling of suspension notices or suspend delivery.  [[#1369], [#1435]]
+
+    `getRawPropertyValues()` now encodes these modeled properties from their
+    typed values.  `withRawProperty()` and `withRawProperties()` decode writes
+    into the typed fields and reject unsupported values.
+
  -  Added vocabulary support for the [FEP-6757] draft, which marks
     ActivityPub content with explicit copyright license URIs.
     [[#1212], [#1241]]
@@ -549,6 +583,10 @@ To be released.
     `@fedify/vocab-tools`.  The writers accept the same `RawPropertyValue`
     shapes as the read functions, copy supplied JSON values, and reject
     malformed or cyclic input before decoding properties.  [[#1355], [#1420]]
+ -  Added the [FEP-f799] context to the preloaded JSON-LD contexts.  The default
+    document loader now resolves <https://w3id.org/fep/f799> locally, so
+    otherwise valid inbound documents can be parsed or verified without
+    depending on the remote context server.  [[#1369], [#1435]]
  -  Added the `VocabularyObject` interface, which every class generated by
     `@fedify/vocab-tools` implements, and the `RawPropertyValue` type with its
     `RawValueObject`, `RawNodeObject`, and `RawListObject` shapes for the
@@ -581,6 +619,12 @@ To be released.
     `https://w3id.org/identity/v1`.  Previously, such a property compacted to
     a prefixed name like `dc:license` without the extra context.
     [[#1212], [#1241]]
+ -  Added the `fedify:typedString` and `fedify:positiveSafeInteger` schema
+    ranges for vocabulary fields that need explicit `xsd:string` or
+    `xsd:integer` datatypes during JSON-LD compaction.  The integer range
+    accepts only positive safe numbers; incompatible incoming values are
+    skipped by these codecs, while raw-property writes reject them.
+    Existing scalar ranges retain their behavior.  [[#1369], [#1435]]
  -  Added `withRawProperty()` and `withRawProperties()` to generated
     vocabulary modules.  Applications can write expanded JSON-LD properties
     without defining typed accessors, including properties on objects from

changes.d/fedify/delivery-suspension-parsers.md

@@ -0,0 +1,26 @@
+---
+links:
+  '#1369': https://github.com/fedify-dev/fedify/issues/1369
+  '#1435': https://github.com/fedify-dev/fedify/pull/1435
+---
+ -  Added raw [FEP-f799] shape tools in
+    `@fedify/fedify/delivery-suspension`.  The asynchronous notice, activity,
+    actor metadata, and inbox metadata parsers preserve expanded IRI spelling,
+    literal values, and multiplicity, and return detached evidence and
+    diagnostics.  Diagnostic `path` values refer to original expanded evidence
+    after expansion succeeds; earlier failures may use input or context
+    pointers. Dropped occurrences retain their original JSON pointer in
+    `rawPath`. Unrelated embedded objects are classified before requiring
+    control-activity fields.  The default loader resolves preloaded contexts
+    locally; applications can explicitly supply a context loader. A
+    conservative context preflight reserves work for both expansions before
+    processing, and marker selection has a fixed collision limit. The parsers
+    reject expanded `@included` outside `@value` literals, and repeated
+    descriptions of an inspected `@id` even when they occur in different named
+    graphs. Reverse assertions about inspected IDs are rejected as well. Strict
+    HTTPS origin helpers validate origin spelling before URL normalization,
+    including IDNA2008 validation against a pinned Unicode 12.0 repertoire.
+    These tools expose unverified claims; they do not authenticate notices,
+    establish controller authority, or suspend delivery. [[#1369], [#1435]]
+
+[FEP-f799]: https://w3id.org/fep/f799

changes.d/vocab-runtime/delivery-suspension-context.md

@@ -0,0 +1,11 @@
+---
+links:
+  '#1369': https://github.com/fedify-dev/fedify/issues/1369
+  '#1435': https://github.com/fedify-dev/fedify/pull/1435
+---
+ -  Added the [FEP-f799] context to the preloaded JSON-LD contexts.  The default
+    document loader now resolves <https://w3id.org/fep/f799> locally, so
+    otherwise valid inbound documents can be parsed or verified without
+    depending on the remote context server.  [[#1369], [#1435]]
+
+[FEP-f799]: https://w3id.org/fep/f799

changes.d/vocab-tools/delivery-suspension-scalars.md

@@ -0,0 +1,11 @@
+---
+links:
+  '#1369': https://github.com/fedify-dev/fedify/issues/1369
+  '#1435': https://github.com/fedify-dev/fedify/pull/1435
+---
+ -  Added the `fedify:typedString` and `fedify:positiveSafeInteger` schema
+    ranges for vocabulary fields that need explicit `xsd:string` or
+    `xsd:integer` datatypes during JSON-LD compaction.  The integer range
+    accepts only positive safe numbers; incompatible incoming values are
+    skipped by these codecs, while raw-property writes reject them.
+    Existing scalar ranges retain their behavior.  [[#1369], [#1435]]

changes.d/vocab/delivery-suspension.md

@@ -0,0 +1,18 @@
+---
+links:
+  '#1369': https://github.com/fedify-dev/fedify/issues/1369
+  '#1435': https://github.com/fedify-dev/fedify/pull/1435
+---
+ -  Added the draft [FEP-f799] `DeliverySuspension` vocabulary type,
+    `Collection.deliveryController`, and `controlledOrigins` on all five
+    actor classes.  The TypeScript `suspensionStatus` accessor preserves the
+    FEP's `status` wire term without merging unrelated status properties.
+    Origin strings retain their spelling, and inbox/controller links are
+    URL-valued without fetching resources.  These additions do not enable
+    handling of suspension notices or suspend delivery.  [[#1369], [#1435]]
+
+    `getRawPropertyValues()` now encodes these modeled properties from their
+    typed values.  `withRawProperty()` and `withRawProperties()` decode writes
+    into the typed fields and reject unsupported values.
+
+[FEP-f799]: https://w3id.org/fep/f799

claude-plugin/skills/actor/SKILL.md

@@ -25,3 +25,20 @@ Walk through:
     is registered.
 
 Reference: <https://fedify.dev/manual/actor>
+
+For draft [FEP-f799] delivery-suspension metadata, the five actor classes
+expose `controlledOrigins` as strings.  Preserve their spelling until the
+application validates them.  An actor's claim alone does not establish
+origin control: verify the reciprocal origin WebFinger relation separately.
+`Collection.deliveryController` is a URL-valued shared-inbox controller claim;
+it does not fetch the actor or grant authority.  These vocabulary properties
+do not enable receiving or suspend outbound delivery.
+
+Inspect actor and inbox control claims with `parseActorControlMetadata()`
+and `parseInboxControlMetadata()` from
+`@fedify/fedify/delivery-suspension`.  Use `expectedId` to require an exact
+expanded representation ID.  The results retain absent, single, multiple,
+and invalid link states, including unresolved endpoint links; they do not
+establish controller authority or fetch linked resources.
+
+[FEP-f799]: https://w3id.org/fep/f799

claude-plugin/skills/fep/SKILL.md

@@ -49,3 +49,39 @@ Fedify implementation
 Explain which Fedify APIs are relevant to the implementation: vocabulary
 types in `@fedify/vocab`, custom context handling, dispatcher or inbox
 listener patterns.
+
+For draft [FEP-f799], `@fedify/vocab` provides `DeliverySuspension`,
+`Collection.deliveryController`, and `controlledOrigins` on all five actor
+classes.  `DeliverySuspension.suspensionStatus` uses the wire term `status`
+and only the FEP-f799 IRI, independently of unrelated status vocabularies.
+The default document loader resolves the FEP context locally.  These are
+inert vocabulary tools: constructing or parsing them does not authenticate a
+notice, verify controller authority, advertise a capability, or suspend
+delivery. Validate the original JSON-LD before applying protocol decisions;
+generated accessors can skip malformed values and hide multiplicity.
+
+For raw FEP-f799 documents, use the tools in
+`@fedify/fedify/delivery-suspension`:
+`parseDeliverySuspensionDocument()`,
+`parseDeliverySuspensionActivityDocument()`,
+`parseActorControlMetadata()`, and `parseInboxControlMetadata()`.
+These asynchronous parsers retain multiplicity and return detached raw and
+expanded evidence.  Their default context loader resolves only preloaded
+contexts; an explicit `contextLoader` must bound its own I/O.
+Before expansion, context preflight applies a conservative work budget and
+may reject valid JSON-LD outside the supported profile.
+The parsers reject expanded `@included` outside `@value` literals and repeated
+descriptions of inspected IDs, including across named graphs. Properties
+asserted through `@reverse` for inspected IDs are rejected too. The duplicate
+check covers the root node and, depending on the parser, the nodes directly
+under an activity's `object` or an actor's `endpoints`. Descriptions of other
+IDs, and references with only `@id` and an optional `@index`, may repeat. This
+check treats `@value` payloads as opaque; other profile limits still apply. Use
+`parseDeliverySuspensionOrigin()` for root-origin identifiers and
+`getDeliverySuspensionUrlOrigin()` for endpoint origins.  The origin helpers
+apply IDNA2008 with a pinned Unicode 12.0 repertoire. Successful parsing
+establishes shape consistency only.  Authentication, controller authority,
+replay checks, and signed-state equality still require separate validation.  An
+`Undo` result contains an unverified activity claim.
+
+[FEP-f799]: https://w3id.org/fep/f799

packages/fedify/deno.json

@@ -5,6 +5,7 @@
   "exports": {
     ".": "./src/mod.ts",
     "./compat": "./src/compat/mod.ts",
+    "./delivery-suspension": "./src/delivery-suspension/mod.ts",
     "./federation": "./src/federation/mod.ts",
     "./nodeinfo": "./src/nodeinfo/mod.ts",
     "./otel": "./src/otel/mod.ts",

packages/fedify/package.json

@@ -77,6 +77,16 @@
       "require": "./dist/compat/mod.cjs",
       "default": "./dist/compat/mod.js"
     },
+    "./delivery-suspension": {
+      "types": {
+        "import": "./dist/delivery-suspension/mod.d.ts",
+        "require": "./dist/delivery-suspension/mod.d.cts",
+        "default": "./dist/delivery-suspension/mod.d.ts"
+      },
+      "import": "./dist/delivery-suspension/mod.js",
+      "require": "./dist/delivery-suspension/mod.cjs",
+      "default": "./dist/delivery-suspension/mod.js"
+    },
     "./federation": {
       "types": {
         "import": "./dist/federation/mod.d.ts",