@fedify/fedify 2.1.27 → 2.1.29

package/dist/{key-CDIMbgsc.mjs → key-O-ATwIGS.mjs}

@@ -1,12 +1,70 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BR2CGENT.mjs";
+import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 //#region src/sig/key.ts
+/** Classifies decoding failures without hiding unexpected loader errors. */
+function classifyKeyJsonLdError(error, seen = /* @__PURE__ */ new Set()) {
+	if (!(error instanceof Error) || !error.name.startsWith("jsonld.")) return null;
+	if (seen.has(error)) throw error;
+	seen.add(error);
+	const details = error.details;
+	if (typeof details?.code !== "string") return null;
+	if (details.code !== "loading remote context failed" || !("cause" in details) && !("cause" in error)) return "invalid";
+	const cause = "cause" in details ? details.cause : error.cause;
+	const nestedFailure = classifyKeyJsonLdError(cause, seen);
+	if (nestedFailure != null) return nestedFailure;
+	if (cause instanceof SyntaxError) return "invalid";
+	if (cause instanceof FetchError || cause instanceof UrlError) return "fetch";
+	if (cause instanceof Error && [
+		"AbortError",
+		"TimeoutError",
+		"NetworkError"
+	].includes(cause.name)) return "fetch";
+	if (cause instanceof TypeError) {
+		const urlCode = cause.code;
+		if (cause.name === "InvalidContextReferenceError") return "invalid";
+		if (urlCode === "ERR_INVALID_URL" || cause.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(cause.message) || / cannot be parsed as a URL\.?$/.test(cause.message)) return typeof details.url === "string" && /^[A-Za-z][A-Za-z0-9+.-]*:/.test(details.url) && !URL.canParse(details.url) ? "invalid" : "fetch";
+		const networkCause = cause.cause;
+		const code = cause.code ?? networkCause?.code;
+		if (typeof code === "string" && [
+			"ECONNREFUSED",
+			"ECONNRESET",
+			"ECONNABORTED",
+			"ETIMEDOUT",
+			"EHOSTUNREACH",
+			"ENETUNREACH",
+			"ENOTFOUND",
+			"EAI_AGAIN",
+			"UND_ERR_CONNECT_TIMEOUT",
+			"UND_ERR_HEADERS_TIMEOUT",
+			"UND_ERR_BODY_TIMEOUT",
+			"UND_ERR_SOCKET"
+		].includes(code) || /^(fetch failed|Failed to fetch|error sending request|error reading a body from connection|Unable to connect|ConnectionRefused|Network connection lost|The socket connection was closed unexpectedly)/.test(cause.message)) return "fetch";
+	}
+	throw cause;
+}
+/** Carries a context transport failure through the key decoding boundary. */
+var KeyContextFetchError = class extends Error {
+	constructor(error) {
+		super("Failed to fetch a key's JSON-LD context.", { cause: error });
+		this.error = error;
+	}
+};
+function contextFetchError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	while (error instanceof Error && !seen.has(error)) {
+		seen.add(error);
+		const details = error.details;
+		if (!error.name.startsWith("jsonld.") || details?.code !== "loading remote context failed") break;
+		error = "cause" in details ? details.cause : error.cause;
+	}
+	return new KeyContextFetchError(error);
+}
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
 * otherwise throws an error.
@@ -101,6 +159,9 @@ async function importJwk(jwk, type) {
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
+	return await fetchActorDocumentInternal(actorId, options, false);
+}
+async function fetchActorDocumentInternal(actorId, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -131,9 +192,12 @@ async function fetchActorDocument(actorId, options = {}) {
 			baseUrl: documentUrl
 		});
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+		const failure = classifyKeyJsonLdError(error);
+		if (failure === "fetch" && propagateContextFetchErrors) throw contextFetchError(error);
+		if (failure == null && !(error instanceof TypeError)) throw error;
+		logger.debug("Failed to decode the actor document at {documentUrl}: {error}", {
 			documentUrl: documentUrl.href,
+			failure: failure ?? "invalid",
 			error
 		});
 		return null;
@@ -172,6 +236,9 @@ async function fetchActorDocument(actorId, options = {}) {
 * @internal
 */
 async function verifyKeyOwnership(key, options = {}) {
+	return await verifyKeyOwnershipInternal(key, options, false);
+}
+async function verifyKeyOwnershipInternal(key, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -181,7 +248,7 @@ async function verifyKeyOwnership(key, options = {}) {
 	if (keyId == null) return null;
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (claimedOwnerId == null) return null;
-	const owner = await fetchActorDocument(claimedOwnerId, options);
+	const owner = await fetchActorDocumentInternal(claimedOwnerId, options, propagateContextFetchErrors);
 	if (owner == null) {
 		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
 			keyId: keyId.href,
@@ -333,6 +400,21 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 			tracerProvider
 		});
 	} catch (e) {
+		const failure = classifyKeyJsonLdError(e);
+		if (failure === "fetch") throw contextFetchError(e);
+		if (failure != null) {
+			logger.debug("Failed to decode key {keyId}: {error}", {
+				keyId,
+				failure,
+				error: e
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
 		if (!(e instanceof TypeError)) throw e;
 		try {
 			object = await cls.fromJsonLd(document, {
@@ -341,8 +423,14 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				tracerProvider
 			});
 		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+			const failure = classifyKeyJsonLdError(e);
+			if (failure === "fetch") throw contextFetchError(e);
+			if (failure != null || e instanceof TypeError) {
+				logger.debug("Failed to decode key {keyId}: {error}", {
+					keyId,
+					failure: failure ?? "invalid",
+					error: e
+				});
 				await keyCache?.set(cacheKey, null);
 				await clearFetchErrorMetadata(cacheKey, keyCache);
 				return {
@@ -434,16 +522,17 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
 	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
-		if (await verifyKeyOwnership(key, {
+		if (await verifyKeyOwnershipInternal(key, {
 			documentLoader,
 			contextLoader,
 			tracerProvider
-		}) == null) {
+		}, true) == null) {
 			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
 				keyId,
 				claimedOwnerId: claimedOwnerId.href
 			});
 			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
 			return {
 				key: null,
 				cached: false
@@ -481,7 +570,12 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 	} catch (error) {
 		return await onFetchError(error, cacheKey, keyId, keyCache, logger);
 	}
-	return await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+	try {
+		return await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+	} catch (error) {
+		if (!(error instanceof KeyContextFetchError)) throw error;
+		return await onFetchError(error.error, cacheKey, keyId, keyCache, logger);
+	}
 }
 async function fetchKeyInternal(keyId, cls, options = {}) {
 	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {

package/dist/{kv-cache-cTsPZ49Z.js → kv-cache-8Kg2CHiD.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { f as validateCryptoKey, t as doubleKnock } from "./http-DQVY5EMT.js";
+import { f as validateCryptoKey, t as doubleKnock } from "./http-B3rSb2GQ.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
@@ -56,6 +56,8 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAge
 		});
 	}
 	async function validateUrl(url) {
+		const protocol = new URL(url).protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new UrlError(`Unsupported protocol: ${protocol}`);
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(url);
 		} catch (error) {

package/dist/{kv-cache-FfmHQljR.cjs → kv-cache-BdylAE9w.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-CsQRvInz.cjs");
+const require_http = require("./http-Cginz7L0.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
@@ -57,6 +57,8 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAge
 		});
 	}
 	async function validateUrl(url) {
+		const protocol = new URL(url).protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new _fedify_vocab_runtime.UrlError(`Unsupported protocol: ${protocol}`);
 		if (!allowPrivateAddress) try {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
 		} catch (error) {

package/dist/{ld-BpkaBh2H.mjs → ld-C-fCGM-z.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BR2CGENT.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-CDIMbgsc.mjs";
+import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-O-ATwIGS.mjs";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{middleware-DwEVn3gK.js → middleware-41MkquTV.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { a as verifyRequestDetailed, d as importJwk, f as validateCryptoKey, i as verifyRequest, m as formatAcceptSignature, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as name, y as version } from "./http-DQVY5EMT.js";
+import { a as verifyRequestDetailed, d as importJwk, f as validateCryptoKey, i as verifyRequest, m as formatAcceptSignature, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as name, y as version } from "./http-B3rSb2GQ.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-miAYfiGO.js";
-import { _ as signJsonLd, a as doesActorOwnKey, c as assertSafeJsonLd, f as detachSignature, g as isInvalidUrlTypeError, h as isClearlyMalformedContextReference, m as hasSignature, n as signObject, o as getKeyOwner, p as getNormalizationContextLoader, r as verifyObject, s as InvalidContextReferenceError, u as compactJsonLd, v as verifyCompactJsonLd, x as wrapContextLoaderForJsonLd } from "./proof-uEay4EIq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-cTsPZ49Z.js";
+import { _ as signJsonLd, a as doesActorOwnKey, c as assertSafeJsonLd, f as detachSignature, g as isInvalidUrlTypeError, h as isClearlyMalformedContextReference, m as hasSignature, n as signObject, o as getKeyOwner, p as getNormalizationContextLoader, r as verifyObject, s as InvalidContextReferenceError, u as compactJsonLd, v as verifyCompactJsonLd, x as wrapContextLoaderForJsonLd } from "./proof-cGfRPTiV.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-8Kg2CHiD.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -52,12 +52,33 @@ var InboxListenerSet = class InboxListenerSet {
 		return this.dispatchWithClass(activity)?.listener ?? null;
 	}
 };
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
@@ -92,14 +113,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -1798,6 +1811,36 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -3316,6 +3359,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -4428,20 +4498,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -4450,6 +4506,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/{middleware-DVaturw-.mjs → middleware-C9UCWOqw.mjs}

@@ -2,25 +2,25 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-BR2CGENT.mjs";
+import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
 import { t as formatAcceptSignature } from "./accept-BavzedPB.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-CDIMbgsc.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-QzHm1vsW.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-BDHKVMoV.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-O-ATwIGS.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-C1ga9WQu.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-DrxXBFL8.mjs";
 import { n as kvCache } from "./kv-cache-DqEKe5E0.mjs";
 import { t as KvKeyCache } from "./keycache-RFlZObU3.mjs";
-import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-BpkaBh2H.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DnOwKsK6.mjs";
-import { n as signObject, r as verifyObject } from "./proof-CShmVLWt.mjs";
+import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-C-fCGM-z.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-C8IVASD3.mjs";
+import { n as signObject, r as verifyObject } from "./proof-CUdcBgvg.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CjDMsn4a.mjs";
 import { t as nodeInfoToJson } from "./types-DCP0WLdt.mjs";
-import { n as routeActivity } from "./inbox-DEXoNgGa.mjs";
-import { t as FederationBuilderImpl } from "./builder-CKQkP3a2.mjs";
+import { n as actorsHaveSameOrigin, r as routeActivity } from "./inbox-BWzL0xMU.mjs";
+import { t as FederationBuilderImpl } from "./builder-Mg2G3qj8.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-BD6-SZ6O.mjs";
 import { t as acceptsJsonLd } from "./negotiation-BehA2uul.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-C96jXvaM.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-BJlnku_d.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-B_E3V_Dx.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-DCg0WblG.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BoV4dyVO.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -812,6 +812,36 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -2007,6 +2037,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -3119,20 +3176,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -3141,6 +3184,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,