@fedify/fedify 2.0.33-dev.2413 → 2.0.33-dev.2414

package/dist/federation/mq.test.mjs

@@ -2,8 +2,8 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { r as assertGreaterOrEqual } from "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import { r as assertGreaterOrEqual } from "../std__assert-DflMZha5.mjs";
+import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { test } from "@fedify/fixture";
 import { delay } from "es-toolkit";

package/dist/federation/negotiation.test.mjs

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import "../std__assert-DflMZha5.mjs";
+import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as acceptsJsonLd } from "../negotiation-TWEs6Cl8.mjs";
 import { test } from "@fedify/fixture";

package/dist/federation/retry.test.mjs

@@ -2,7 +2,7 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { l as AssertionError, t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
+import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as createExponentialBackoffPolicy } from "../retry-Ddbq3AcK.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/retry.test.ts

package/dist/federation/router.test.mjs

@@ -3,10 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError, t as Router } from "../router-CrMLXoOr.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import "../std__assert-DflMZha5.mjs";
+import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/router.test.ts
 function setUp(options = {}) {

package/dist/federation/send.test.mjs

@@ -3,14 +3,15 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
+import "../std__assert-DflMZha5.mjs";
+import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { l as verifyRequest } from "../http-C8SYUIha.mjs";
+import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
+import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
+import { l as verifyRequest } from "../http-BRdkmpRl.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { t as doesActorOwnKey } from "../owner-BUnSHtD3.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-BVjpjEY-.mjs";
+import { t as doesActorOwnKey } from "../owner-DRXYR3jY.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-CVlj4zuA.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/temporal.test.mjs

@@ -1,10 +1,10 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import "../std__assert-DflMZha5.mjs";
+import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-D58JcKAc.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-BwiXwu1s.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
+import "../std__assert-DflMZha5.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as createFederation, o as handleWebFinger } from "../middleware-Cm5Kx7Nr.mjs";
+import { a as createFederation, o as handleWebFinger } from "../middleware-a9um4sWr.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts

package/dist/{http-C8SYUIha.mjs → http-BRdkmpRl.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-1poG3nVL.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-CDuFq0mQ.mjs";
+import { n as version, t as name } from "./deno-v7kfTDw9.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-qe6uT5ER.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/{http-0H3c-FW0.cjs → http-CytEl2_x.cjs}

@@ -11,7 +11,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let structured_field_values = require("structured-field-values");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.33-dev.2413+bacabf0a";
+var version = "2.0.33-dev.2414+98deefa2";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */

package/dist/{http-DaS2vnNk.js → http-i02DDItX.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.33-dev.2413+bacabf0a";
+var version = "2.0.33-dev.2414+98deefa2";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */

package/dist/{inbox-DvbsFXWB.mjs → inbox-Bj-VABWa.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-1poG3nVL.mjs";
+import { n as version, t as name } from "./deno-v7kfTDw9.mjs";
 import { Activity, getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -39,12 +39,33 @@ var InboxListenerSet = class InboxListenerSet {
 		return this.dispatchWithClass(activity)?.listener ?? null;
 	}
 };
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
@@ -79,14 +100,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -179,4 +192,4 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
-export { routeActivity as n, InboxListenerSet as t };
+export { actorsHaveSameOrigin as n, routeActivity as r, InboxListenerSet as t };

package/dist/{key-CDuFq0mQ.mjs → key-qe6uT5ER.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-1poG3nVL.mjs";
+import { n as version, t as name } from "./deno-v7kfTDw9.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{kv-cache-BNiY7ea-.cjs → kv-cache-CCCwr3Y2.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-0H3c-FW0.cjs");
+const require_http = require("./http-CytEl2_x.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");

package/dist/{kv-cache-B7T3rhpo.js → kv-cache-DT2Fk4wy.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { l as validateCryptoKey, t as doubleKnock } from "./http-DaS2vnNk.js";
+import { l as validateCryptoKey, t as doubleKnock } from "./http-i02DDItX.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/{ld-5AEMxXBH.mjs → ld-gf5riP2W.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-1poG3nVL.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-CDuFq0mQ.mjs";
+import { n as version, t as name } from "./deno-v7kfTDw9.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-qe6uT5ER.mjs";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{middleware-CKBMWB3q.cjs → middleware-BDniN395.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-DlYK6kvo.cjs");
+const require_middleware = require("./middleware-C_ybJNaa.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/{middleware-DlYK6kvo.cjs → middleware-C_ybJNaa.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-0H3c-FW0.cjs");
+const require_http = require("./http-CytEl2_x.cjs");
 const require_types = require("./types-DRPjmHVV.cjs");
-const require_proof = require("./proof-Bg4dnzAo.cjs");
-const require_kv_cache = require("./kv-cache-BNiY7ea-.cjs");
+const require_proof = require("./proof-BS0ckB77.cjs");
+const require_kv_cache = require("./kv-cache-CCCwr3Y2.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -53,12 +53,33 @@ var InboxListenerSet = class InboxListenerSet {
 		return this.dispatchWithClass(activity)?.listener ?? null;
 	}
 };
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href);
@@ -93,14 +114,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: _opentelemetry_api.SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -336,7 +349,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-CKBMWB3q.cjs"));
+		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-BDniN395.cjs"));
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -1160,8 +1173,8 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
@@ -1203,7 +1216,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 			collection = new _fedify_vocab.OrderedCollection({
 				id: baseUri,
 				totalItems: totalItems == null ? null : Number(totalItems),
-				items: filterCollectionItems(itemsOrResponse, name$1, filterPredicate)
+				items: filterCollectionItems(itemsOrResponse, name$2, filterPredicate)
 			});
 		} else {
 			const lastCursor = await collectionCallbacks.lastCursor?.(context, identifier);
@@ -1224,7 +1237,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 	} else {
 		const uri = new URL(baseUri);
 		uri.searchParams.set("cursor", cursor);
-		const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+		const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 			kind: _opentelemetry_api.SpanKind.SERVER,
 			attributes: {
 				"activitypub.collection.id": uri.href,
@@ -1268,7 +1281,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 			id: uri,
 			prev,
 			next,
-			items: filterCollectionItems(items, name$1, filterPredicate),
+			items: filterCollectionItems(items, name$2, filterPredicate),
 			partOf
 		});
 	}
@@ -1654,6 +1667,36 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -1782,8 +1825,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -3092,6 +3135,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", (0, _fedify_vocab.getTypeId)(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -4202,20 +4272,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -4224,6 +4280,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/{middleware-NUR07Wjx.mjs → middleware-GCF6LA-a.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-Cm5Kx7Nr.mjs";
+import { n as FederationImpl } from "./middleware-a9um4sWr.mjs";
 export { FederationImpl };