fix: start delivery queue and enable authenticated shared inbox fetches

Two critical fixes for ActivityPub federation:

1. Call federation.startQueue() — without this, ctx.sendActivity() enqueues
   delivery tasks but the InProcessMessageQueue never processes them, so
   activities are never actually POSTed to follower inboxes.

2. Add setSharedKeyDispatcher on the shared inbox — enables Fedify to make
   signed/authenticated GET requests when verifying incoming HTTP Signatures.
   Servers with authorized fetch (e.g. hachyderm.io) return 401 on unsigned
   requests, which prevented Fedify from fetching sender public keys and
   caused all incoming activities to be rejected.

lib/federation-setup.js

@@ -162,6 +162,13 @@ export function setupFederation(options) {
     storeRawActivities,
   });
 
+  // Enable authenticated fetches for the shared inbox.
+  // Without this, Fedify can't verify incoming HTTP Signatures from servers
+  // that require authorized fetch (e.g. hachyderm.io returns 401 on unsigned GETs).
+  // This tells Fedify to use our actor's key pair when fetching remote actor
+  // documents during signature verification on the shared inbox.
+  inboxChain.setSharedKeyDispatcher((_ctx) => ({ identifier: handle }));
+
   // --- Collection dispatchers ---
   setupFollowers(federation, mountPath, handle, collections);
   setupFollowing(federation, mountPath, handle, collections);
@@ -187,6 +194,14 @@ export function setupFederation(options) {
     };
   });
 
+  // Start the message queue for outbound activity delivery.
+  // Without this, ctx.sendActivity() enqueues delivery tasks but the
+  // InProcessMessageQueue never processes them — activities are never
+  // actually POSTed to follower inboxes.
+  federation.startQueue().catch((error) => {
+    console.error("[ActivityPub] Failed to start delivery queue:", error.message);
+  });
+
   return { federation };
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",