fix: skip Fedify middleware for non-GET requests in contentNegotiationRoutes

The contentNegotiationRoutes getter is mounted at root / and was passing
ALL requests through Fedify, including POST requests to admin routes.
fromExpressRequest() calls Readable.toWeb(req) which consumes the body
stream, causing "response body object should not be distributed or locked"
errors when admin controllers try to read req.body.

The v1.0.2 fix only protected routesPublic (mounted at /activitypub).
This fixes the actual culprit by skipping non-GET/HEAD methods in
contentNegotiationRoutes, since content negotiation and NodeInfo are
both GET-only concerns.

index.js

@@ -150,8 +150,12 @@ export default class ActivityPubEndpoint {
     const self = this;
 
     // Let Fedify handle NodeInfo data (/nodeinfo/2.1)
+    // Only pass GET/HEAD requests — POST/PUT/DELETE must not go through
+    // Fedify here, because fromExpressRequest() consumes the body stream,
+    // breaking Express body-parsed routes downstream (e.g. admin forms).
     router.use((req, res, next) => {
       if (!self._fedifyMiddleware) return next();
+      if (req.method !== "GET" && req.method !== "HEAD") return next();
       return self._fedifyMiddleware(req, res, next);
     });
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",