@fedify/fedify 2.5.0-dev.2440 → 2.5.0-dev.2448

package/dist/{middleware-CDdFG6xf.mjs → middleware-CuVa0UuS.mjs}

@@ -3,34 +3,37 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri, f as isSameObjectId, i as getPortableDid, l as isPortableId, n as getCanonicalPortableId, o as hasPortableActor, r as getGatewayKeyBase, s as isCompatibleKeyId, t as getAuthenticationOrigin, u as isPortableKeyId } from "./portable-key-id-Ca30-hOa.mjs";
 import { n as isPubliclyAddressedNode, t as isInAudience } from "./audience-CHQ-FlLD.mjs";
+import { i as getEmptyAuthenticationEvidence, n as deserializeAuthentication, t as createAuthenticationEvidence } from "./inbox-authentication-DflPYlLL.mjs";
 import { a as verificationObservation, r as snapshotKey, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-DR1uYWpm.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DIM8ZCKq.mjs";
+import { n as version, t as name } from "./deno-Dpewt_jJ.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B-QxRSSR.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { T as validateCryptoKey, _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike, w as importJwk, y as exportJwk } from "./ld-CUM16-EE.mjs";
+import { r as getVerifiedKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
+import { D as validateCryptoKey, E as importJwk, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, g as verifyCompactJsonLdDetailed, l as hasSignature, m as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike, x as exportJwk, y as wrapContextLoaderForJsonLd } from "./ld-CQFuiah9.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as verifyObject, d as verifyPortableObjectProofWithRoot, i as hasProofLike, l as verifyPortableObjectProof, o as signObject, t as InvalidPortableObjectIdError } from "./proof-DWpruPWs.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-CRrg14tX.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-BpCJ2dHm.mjs";
-import { n as kvCache } from "./kv-cache-MxJrD9gD.mjs";
+import { a as hasProofLike, d as verifyPortableObjectProof, i as getProofSigner, l as verifyObject, p as verifyPortableObjectProofWithRoot, s as signObject, t as InvalidPortableObjectIdError, u as verifyObjectDetailed } from "./proof-DPoF06nz.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BZkyQIkb.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-CpsDyqVN.mjs";
+import { n as kvCache } from "./kv-cache-CTQSfkmp.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DoQDS_g0.mjs";
-import { t as verifyPortableObject } from "./portable-collection-DiBqtGSM.mjs";
-import { a as getOrderingDestination, i as sendActivityThroughGateways, n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-H0z9Ey5l.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CTasaZgj.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-ccKkQOAf.mjs";
+import { t as verifyPortableObject } from "./portable-collection-CndnpXfo.mjs";
+import { a as getOrderingDestination, i as sendActivityThroughGateways, n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-CF44O1Df.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-DbC8bn6k.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-XJ53md4S.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-D5r-dQMr.mjs";
-import { n as routeActivity, t as actorsHaveSameOrigin } from "./inbox-BwPoSUEv.mjs";
+import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-heeXW2_A.mjs";
+import { a as isActorlessActivityAuthenticated, i as getInboxIdempotencyKey, n as checkActorlessActivity, o as isInboxActivityProcessed, s as routeActivity, t as actorsHaveSameOrigin } from "./inbox-wDuMKaFW.mjs";
+import { c as expandDocument, d as parseSerializedVerifiedActivityView, f as restoreVerifiedActivityView, i as createReleasableLoader, l as getActorPresence, n as buildVerifiedActivityView, o as deepFreeze, r as createContextSnapshot, t as ContextSnapshotMissError } from "./inbox-view-NE9wXdLo.mjs";
 import { t as KvKeyCache } from "./keycache-N2opu4-3.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-BiSBCImA.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-XlZ4Wb94.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
-import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
+import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, isActor, lookupObject, lookupObserver, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { FetchError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, resolveDocumentLoaderTimeout, toCompatibleEf61Id } from "@fedify/vocab-runtime";
@@ -1568,13 +1571,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1620,7 +1623,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1662,7 +1665,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1678,7 +1681,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -2175,11 +2178,12 @@ async function handleInbox(request, options) {
 	}, async (span) => {
 		if (options.recipient != null) span.setAttribute("fedify.inbox.recipient", options.recipient);
 		const spanContext = span.spanContext();
+		const snapshot = createContextSnapshot(options.context.contextLoader);
 		try {
 			return await withContext({
 				traceId: spanContext.traceId,
 				spanId: spanContext.spanId
-			}, () => handleInboxInternal(request, options, span));
+			}, () => handleInboxInternal(request, options, span, snapshot));
 		} catch (e) {
 			options.observation.hasException = true;
 			span.setStatus({
@@ -2188,6 +2192,7 @@ async function handleInbox(request, options) {
 			});
 			throw e;
 		} finally {
+			snapshot.release();
 			options.observation.project(span);
 			span.end();
 		}
@@ -2199,9 +2204,10 @@ async function handleInbox(request, options) {
 * @param request The HTTP request.
 * @param options The parameters for handling the inbox.
 * @param span The OpenTelemetry span for tracing.
+* @param snapshot The context snapshot of the delivery.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleInboxInternal(request, parameters, span) {
+async function handleInboxInternal(request, parameters, span, snapshot) {
 	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const observation = parameters.observation;
 	const signatureObservation = { [verificationObservation]: observation.verification };
@@ -2315,6 +2321,8 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		keyTtl: publicKeyTtl
 	});
+	const standardLoader = snapshot.loader("standard");
+	const normalizationLoader = snapshot.loader("normalization");
 	const jsonWithoutSig = detachSignature(json);
 	const hasLdSignature = hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -2350,9 +2358,10 @@ async function handleInboxInternal(request, parameters, span) {
 	let compactedJson = json;
 	let compactedJsonWithoutSig = jsonWithoutSig;
 	let ldSigVerified = false;
+	let ldSigKey = null;
 	if (hasLdSignature) {
 		try {
-			compactedJson = await compactJsonLd(json, ctx.contextLoader);
+			compactedJson = await compactJsonLd(json, normalizationLoader);
 		} catch (error) {
 			if (isInvalidJsonLdError(error)) {
 				logger.error("Failed to parse JSON-LD:\n{error}", {
@@ -2388,16 +2397,18 @@ async function handleInboxInternal(request, parameters, span) {
 		if (compactedJson !== json) {
 			compactedJsonWithoutSig = detachSignature(compactedJson);
 			try {
-				ldSigVerified = await verifyCompactJsonLd(compactedJson, {
+				const ldResult = await verifyCompactJsonLdDetailed(compactedJson, {
 					...signatureObservation,
-					contextLoader: ctx.contextLoader,
+					contextLoader: normalizationLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
 					meterProvider,
 					tracerProvider
 				});
+				ldSigVerified = ldResult.verified;
+				ldSigKey = ldResult.key;
 			} catch (error) {
-				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 				if (isInvalidJsonLdError(error)) {
 					logger.error("Failed to parse JSON-LD:\n{error}", {
 						recipient,
@@ -2415,12 +2426,12 @@ async function handleInboxInternal(request, parameters, span) {
 				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 				if (!skipSignatureVerification) try {
 					await Object$1.fromJsonLd(compactedJson, {
-						contextLoader: getNormalizationContextLoader(ctx.contextLoader),
+						contextLoader: normalizationLoader,
 						documentLoader: ctx.documentLoader,
 						tracerProvider
 					});
 				} catch (parseError) {
-					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(parseError);
+					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(parseError);
 					if (isInvalidJsonLdError(parseError)) {
 						logger.error("Failed to parse JSON-LD:\n{error}", {
 							recipient,
@@ -2444,6 +2455,33 @@ async function handleInboxInternal(request, parameters, span) {
 	let activity = null;
 	let activityVerified = false;
 	let proofVerified = false;
+	let documentSigners = [];
+	let requestSigners = [];
+	let viewSource;
+	const rawViewSource = {
+		policy: "standard",
+		source: "activity",
+		document: jsonWithoutSig,
+		baseUrl: null
+	};
+	const isActorlessCandidate = async (candidate, source) => {
+		if (skipSignatureVerification) return false;
+		if (inboxListeners?.dispatchWithClass(candidate)?.options.allowActorless !== true) return false;
+		try {
+			return getActorPresence(await expandDocument(source.document, snapshot.loader(source.policy))) === "absent";
+		} catch {
+			return false;
+		}
+	};
+	const verifyProofs = (contextLoader = standardLoader) => verifyObjectDetailed(Activity, jsonWithoutSig, {
+		...signatureObservation,
+		contextLoader,
+		documentLoader: ctx.documentLoader,
+		keyCache,
+		meterProvider,
+		tracerProvider,
+		verifyPortableObject: ctx.verifyPortableObject
+	});
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -2452,18 +2490,49 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
-				contextLoader: getNormalizationContextLoader(ctx.contextLoader)
+				contextLoader: normalizationLoader
 			});
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		viewSource = {
+			policy: "normalization",
+			source: "normalizedActivity",
+			document: compactedJsonWithoutSig,
+			baseUrl: null
+		};
+		if (ldSigKey?.ownerId != null) documentSigners = [{
+			kind: "actor",
+			id: ldSigKey.ownerId,
+			mechanism: "linkedDataSignatures",
+			keyId: ldSigKey.id
+		}];
+		if (await isActorlessCandidate(activity, viewSource)) {
+			let result = null;
+			try {
+				result = await verifyProofs();
+			} catch (error) {
+				if (!isPermanentActivityParseError(error)) throw error;
+				logger.debug("Failed to verify the Object Integrity Proofs of the activity without an actor:\n{error}", {
+					recipient,
+					error
+				});
+			}
+			if (result?.status === "unavailable") throw result.error;
+			if (result?.status === "verified" && result.signers.length > 0) {
+				activity = observation.activity = result.object;
+				documentSigners = toProofPrincipals(result.signers);
+				viewSource = rawViewSource;
+				proofVerified = true;
+			}
+		}
 		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
 				...signatureObservation,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -2481,18 +2550,11 @@ async function handleInboxInternal(request, parameters, span) {
 			recipient,
 			json
 		});
+		let proofResult;
 		try {
-			activity = await verifyObject(Activity, jsonWithoutSig, {
-				...signatureObservation,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
-				documentLoader: ctx.documentLoader,
-				keyCache,
-				meterProvider,
-				tracerProvider,
-				verifyPortableObject: ctx.verifyPortableObject
-			});
+			proofResult = await verifyProofs();
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, standardLoader)) return await respondInvalidActivity(error);
 			if (deferredLdSignatureError != null) {
 				logger.debug("Object Integrity Proof fallback did not supersede a deferred Linked Data Signature failure:\n{error}", {
 					recipient,
@@ -2528,6 +2590,22 @@ async function handleInboxInternal(request, parameters, span) {
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
 			});
 		}
+		if (proofResult.status === "verified") if (proofResult.signers.length < 1 && await isActorlessCandidate(proofResult.object, rawViewSource)) activity = null;
+		else {
+			activity = proofResult.object;
+			documentSigners = toProofPrincipals(proofResult.signers);
+			viewSource = rawViewSource;
+		}
+		else if (proofResult.status === "unavailable") {
+			let parsed = null;
+			try {
+				parsed = await Activity.fromJsonLd(jsonWithoutSig, {
+					...ctx,
+					contextLoader: standardLoader
+				});
+			} catch {}
+			if (parsed != null && await isActorlessCandidate(parsed, rawViewSource)) throw proofResult.error;
+		}
 		if (activity == null) logger.debug("Object Integrity Proofs are not verified.", {
 			recipient,
 			activity: json
@@ -2657,14 +2735,28 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader)
+				contextLoader: standardLoader
 			});
 		} catch (error) {
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
+		viewSource = rawViewSource;
 	}
 	observation.activity = activity;
+	let view;
+	try {
+		view = await buildVerifiedActivityView(snapshot, viewSource ?? rawViewSource);
+	} catch (error) {
+		if (!isPermanentActivityParseError(error)) throw error;
+		return await respondInvalidActivity(error);
+	}
+	const actorless = !skipSignatureVerification && getActorPresence(view.expanded) === "absent" && inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true;
+	span.setAttribute("activitypub.activity.actorless", actorless);
+	if (actorless && httpSigKey != null) {
+		const principal = getHttpKeyPrincipal(httpSigKey);
+		if (principal != null) requestSigners = [principal];
+	}
 	observation.stage = "policy";
 	observation.result = {
 		disposition: "rejected",
@@ -2708,7 +2800,7 @@ async function handleInboxInternal(request, parameters, span) {
 		const rejection = await observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
 			const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
 				[verificationObservation]: verification,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -2746,7 +2838,7 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 	}
-	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !actorless && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		observation.authentication = {
 			status: "rejected",
@@ -2772,6 +2864,66 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (httpSigKey != null && !actorless && activity.actorId != null) requestSigners = [{
+		kind: "actor",
+		id: activity.actorId,
+		mechanism: "httpSignatures",
+		keyId: httpSigKey.id
+	}];
+	if (actorless) {
+		const check = checkActorlessActivity(activity, {
+			verified: true,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: [],
+			baseUrl: null
+		});
+		if (check.status === "noAuthenticatedPrincipal") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: { type: "noAuthenticatedPrincipal" }
+			};
+			logger.error("The activity {activityId} declares no actor, and no principal is authenticated for it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: "No principal is authenticated for the activity."
+			});
+			return new Response("No principal is authenticated for the activity.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		} else if (check.status === "activityOriginMismatch") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: {
+					type: "activityOriginMismatch",
+					activityId: new URL(activity.id.href),
+					actorIds: check.principals.map((principal) => principal.id)
+				}
+			};
+			logger.error("The activity ({activityId}) does not have the same origin as the principals that authenticated it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href,
+				principals: check.principals.map((principal) => principal.id.href)
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `The activity (${activity.id?.href}) does not have the same origin as the principals that authenticated it.`
+			});
+			return new Response("The activity and its signers do not have the same origin.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (!skipSignatureVerification) {
 		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
 		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
@@ -2831,7 +2983,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
-	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+	if (!skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 		observation.authentication = {
 			status: "rejected",
 			reason: {
@@ -2860,7 +3012,7 @@ async function handleInboxInternal(request, parameters, span) {
 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
 	};
 	observation.stage = "dispatch";
-	if (activity.actorId == null) {
+	if (!actorless && activity.actorId == null) {
 		observation.result = {
 			disposition: "rejected",
 			reason: "missingActor"
@@ -2884,6 +3036,17 @@ async function handleInboxInternal(request, parameters, span) {
 		originalJson: json,
 		normalizedActivity: hasLdSignature && compactedJson !== json ? compactedJson : void 0,
 		ldSignatureVerified: hasLdSignature ? ldSigVerified : void 0,
+		authentication: createAuthenticationEvidence({
+			verified: !skipSignatureVerification,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: deepFreeze(view.expanded),
+			baseUrl: null
+		}),
+		verifiedView: view.view,
+		replayable: view.replayable,
+		actorless,
 		activity,
 		recipient,
 		inboxListeners,
@@ -3098,8 +3261,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -3608,6 +3771,42 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
+* Turns the signers of verified Object Integrity Proofs into principals.
+*/
+function toProofPrincipals(signers) {
+	return signers.map((signer) => ({
+		kind: signer.kind,
+		id: signer.id,
+		mechanism: "objectIntegrityProofs",
+		keyId: signer.keyId
+	}));
+}
+/**
+* Gets the principal of an HTTP Signature key, whose owner was confirmed by
+* the owner's own document, or by the signed document of a portable actor,
+* when the key was fetched.
+*/
+function getHttpKeyPrincipal(key) {
+	const evidence = getVerifiedKeyOwnerEvidence(key);
+	if (evidence != null) try {
+		return {
+			kind: "actor",
+			id: parseIri(evidence.ownerId),
+			mechanism: "httpSignatures",
+			keyId: key.id
+		};
+	} catch {
+		return null;
+	}
+	if (key.ownerId == null || isPortableId(key.ownerId)) return null;
+	return {
+		kind: "actor",
+		id: key.ownerId,
+		mechanism: "httpSignatures",
+		keyId: key.id
+	};
+}
+/**
 * Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
 * actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
 * URI, and it is owned by a portable actor, which only the portable actor's
@@ -5699,24 +5898,102 @@ var FederationImpl = class extends FederationBuilderImpl {
 			let dispatched;
 			let parseInput = void 0;
 			let parseContextLoader = context.contextLoader;
+			let authentication = getEmptyAuthenticationEvidence();
+			let actorPresence = "present";
+			if (message.verifiedView !== void 0) {
+				const view = parseSerializedVerifiedActivityView(message.verifiedView);
+				let restored;
+				let restoredAuthentication = null;
+				let failure;
+				if (view == null) failure = /* @__PURE__ */ new TypeError("The queued activity has a malformed verified view.");
+				else try {
+					if (view.source === "normalizedActivity") assertSafeJsonLd(message.normalizedActivity);
+					restored = await restoreVerifiedActivityView(view, message);
+				} catch (error) {
+					if (!(error instanceof ContextSnapshotMissError) && !isPermanentInboxParseError(error)) {
+						await handleRetriableFailure(error);
+						return;
+					}
+					failure = error;
+				}
+				if (restored != null) {
+					const expandedActivity = deepFreeze(restored.expanded);
+					restoredAuthentication = message.authentication === void 0 ? createAuthenticationEvidence({
+						...getEmptyAuthenticationEvidence(),
+						expandedActivity,
+						baseUrl: restored.baseUrl
+					}) : deserializeAuthentication(message.authentication, expandedActivity, restored.baseUrl);
+					if (restoredAuthentication == null) failure = /* @__PURE__ */ new TypeError("The queued activity has malformed authentication evidence.");
+				}
+				if (failure != null || restored == null || restoredAuthentication == null) {
+					await reportInboxError(failure);
+					logger.error("Failed to replay the queued incoming activity:\n{error}", {
+						error: failure,
+						trial: message.attempt,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: String(failure)
+					});
+					listenerSpan.end();
+					return;
+				}
+				authentication = restoredAuthentication;
+				actorPresence = getActorPresence(restored.expanded);
+				const policy = view.policy;
+				const replayLoader = createReleasableLoader(restored.loader, policy === "normalization" ? getNormalizationContextLoader(context.contextLoader) : wrapContextLoaderForJsonLd(context.contextLoader), policy);
+				parseInput = restored.document;
+				parseContextLoader = restored.loader;
+				try {
+					activity = await Activity.fromJsonLd(restored.document, {
+						...context,
+						contextLoader: replayLoader.loader,
+						...restored.baseUrl == null ? {} : { baseUrl: restored.baseUrl }
+					});
+				} catch (error) {
+					if (isPermanentInboxParseError(error)) {
+						await reportInboxError(error);
+						logger.error("Failed to parse the queued incoming activity:\n{error}", {
+							error,
+							trial: message.attempt,
+							activity: message.activity,
+							recipient: message.identifier
+						});
+						listenerSpan.setStatus({
+							code: SpanStatusCode.ERROR,
+							message: String(error)
+						});
+						listenerSpan.end();
+						return;
+					}
+					await handleRetriableFailure(error);
+					return;
+				} finally {
+					replayLoader.release();
+				}
+			}
 			try {
-				const hasSignatureField = hasSignature(message.activity);
-				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
-				const parseContext = hasSignatureField ? {
-					...context,
-					contextLoader: getNormalizationContextLoader(context.contextLoader)
-				} : {
-					...context,
-					contextLoader: wrapContextLoaderForJsonLd(context.contextLoader)
-				};
-				parseContextLoader = parseContext.contextLoader;
-				let normalizedActivity;
-				if (shouldParseFromNormalizedSignedPayload) {
-					normalizedActivity = message.normalizedActivity ?? await compactJsonLd(message.activity, context.contextLoader);
-					assertSafeJsonLd(normalizedActivity);
+				if (activity == null) {
+					const hasSignatureField = hasSignature(message.activity);
+					const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
+					const parseContext = hasSignatureField ? {
+						...context,
+						contextLoader: getNormalizationContextLoader(context.contextLoader)
+					} : {
+						...context,
+						contextLoader: wrapContextLoaderForJsonLd(context.contextLoader)
+					};
+					parseContextLoader = parseContext.contextLoader;
+					let normalizedActivity;
+					if (shouldParseFromNormalizedSignedPayload) {
+						normalizedActivity = message.normalizedActivity ?? await compactJsonLd(message.activity, context.contextLoader);
+						assertSafeJsonLd(normalizedActivity);
+					}
+					parseInput = shouldParseFromNormalizedSignedPayload ? detachSignature(normalizedActivity) : hasSignatureField ? detachSignature(message.activity) : message.activity;
+					activity = await Activity.fromJsonLd(parseInput, parseContext);
 				}
-				parseInput = shouldParseFromNormalizedSignedPayload ? detachSignature(normalizedActivity) : hasSignatureField ? detachSignature(message.activity) : message.activity;
-				activity = await Activity.fromJsonLd(parseInput, parseContext);
 				activityType = getTypeId(activity).href;
 				span.setAttribute("activitypub.activity.type", activityType);
 				listenerSpan.setAttribute("activitypub.activity.type", activityType);
@@ -5725,7 +6002,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 					span.setAttribute("activitypub.activity.id", activity.id.href);
 					listenerSpan.setAttribute("activitypub.activity.id", activity.id.href);
 				}
-				if (activity.actorId == null) {
+				const actorless = actorPresence === "absent" && !this.skipSignatureVerification && authentication.verified && this.inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true && isActorlessActivityAuthenticated(activity, authentication);
+				if (activity.actorId == null && !actorless) {
 					logger.error("Missing actor in queued incoming activity.", {
 						activityId: activity.id?.href,
 						activity: message.activity,
@@ -5739,7 +6017,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+				if (!this.skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
 						activityId: activity.id.href,
 						actorIds: activity.actorIds.map((actor) => actor.href),
@@ -5754,22 +6032,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				cacheKey = activity.id == null ? null : [
-					...this.kvPrefixes.activityIdempotence,
-					context.origin,
-					activity.id.href
-				];
-				if (cacheKey != null) {
-					if (await this.kv.get(cacheKey) === true) {
-						logger.debug("Activity {activityId} has already been processed.", {
-							activityId: activity.id?.href,
-							activity: message.activity,
-							recipient: message.identifier
-						});
-						recordInboxActivity(this.meterProvider, "rejected", activityType);
-						listenerSpan.end();
-						return;
-					}
+				const parsedActivity = activity;
+				const parsedActivityType = activityType;
+				cacheKey = await getInboxIdempotencyKey(this.idempotencyStrategy, () => context.toInboxContext(message.identifier, message.activity, parsedActivity.id?.href, parsedActivityType, { authentication }), activity, context.origin, message.identifier, this.kvPrefixes.activityIdempotence);
+				if (await isInboxActivityProcessed(this.kv, cacheKey, activity, context.origin, this.kvPrefixes.activityIdempotence)) {
+					logger.debug("Activity {activityId} has already been processed.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
 				}
 				dispatched = this.inboxListeners?.dispatchWithClass(activity);
 			} catch (error) {
@@ -5828,7 +6102,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			try {
 				const started = performance.now();
 				try {
-					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType, { authentication }), activity);
 				} finally {
 					this.metrics.recordInboxProcessingDuration(activityType, getDurationMs(started));
 				}
@@ -7135,7 +7409,7 @@ var ContextImpl = class ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
 		});
 	}
-	toInboxContext(recipient, activity, activityId, activityType) {
+	toInboxContext(recipient, activity, activityId, activityType, metadata) {
 		return new InboxContextImpl(recipient, activity, activityId, activityType, {
 			url: this.url,
 			federation: this.federation,
@@ -7143,7 +7417,7 @@ var ContextImpl = class ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, metadata?.authentication);
 	}
 	toOutboxContext(identifier, activity, activityId, activityType) {
 		return new OutboxContextImpl(identifier, activity, activityId, activityType, {
@@ -7525,7 +7799,8 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.federation._meterProvider,
-			allowPrivateAddress: this.federation.allowPrivateAddress
+			allowPrivateAddress: this.federation.allowPrivateAddress,
+			withDiagnostics: false
 		});
 	}
 	async enqueueTask(task, data, options = {}) {
@@ -7757,12 +8032,20 @@ var ContextImpl = class ContextImpl {
 		});
 	}
 	async routeActivityInternal(recipient, activity, options = {}, span) {
+		const snapshot = createContextSnapshot(options.contextLoader ?? this.contextLoader);
+		try {
+			return await this.#routeActivityWithSnapshot(recipient, activity, options, span, snapshot);
+		} finally {
+			snapshot.release();
+		}
+	}
+	async #routeActivityWithSnapshot(recipient, activity, options, span, snapshot) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
 			"inbox"
 		]);
-		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const contextLoader = snapshot.loader("standard");
 		let json = await activity.toJsonLd({ contextLoader });
 		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
 			documentLoader: this.documentLoader,
@@ -7770,13 +8053,19 @@ var ContextImpl = class ContextImpl {
 			tracerProvider: this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
 		});
-		if (await verifyObject(Activity, json, {
+		let documentSigners = [];
+		let originAuthenticated = [];
+		let viewSource;
+		let fetchedView;
+		const document = detachSignature(json);
+		const verified = await verifyObjectDetailed(Activity, document, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			meterProvider: this.meterProvider,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyCache
-		}) == null) {
+		});
+		if (verified.status !== "verified") {
 			logger.debug("Object Integrity Proofs are not verified.", {
 				recipient,
 				activity: json
@@ -7788,8 +8077,29 @@ var ContextImpl = class ContextImpl {
 				});
 				return false;
 			}
-			const fetched = await this.lookupObject(activity.id, options);
-			if (fetched == null) {
+			let candidate;
+			let candidateView;
+			const verifications = /* @__PURE__ */ new WeakMap();
+			const fetched = await this.lookupObject(activity.id, {
+				...options,
+				contextLoader,
+				verifyPortableObject: async (document, verifierOptions) => {
+					const result = await this.verifyPortableObject(document, verifierOptions);
+					if (document != null && typeof document === "object") verifications.set(document, result);
+					return result;
+				},
+				[lookupObserver]: { accept: async (accepted) => {
+					candidate = accepted;
+					candidateView = await buildVerifiedActivityView(createContextSnapshot(accepted.contextLoader), {
+						policy: "standard",
+						source: "activity",
+						document: detachSignature(accepted.document),
+						baseUrl: accepted.baseUrl
+					});
+					return true;
+				} }
+			});
+			if (fetched == null || candidate == null || candidateView == null) {
 				logger.debug("Failed to fetch the remote activity object {activityId}.", {
 					recipient,
 					activity: json,
@@ -7825,11 +8135,50 @@ var ContextImpl = class ContextImpl {
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
-			json = await fetched.toJsonLd({ contextLoader });
-		} else logger.debug("Object Integrity Proofs are verified.", {
-			recipient,
-			activity: json
-		});
+			json = candidate.document;
+			fetchedView = candidateView;
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document: detachSignature(candidate.document),
+				baseUrl: candidate.baseUrl
+			};
+			if (isPortableId(fetched.id)) {
+				const result = verifications.get(candidate.document);
+				if (result?.verified === true && result.method === "proof") documentSigners = result.keys.flatMap((key) => {
+					const signer = getProofSigner(key);
+					return signer == null ? [] : [{
+						kind: signer.kind,
+						id: signer.id,
+						mechanism: "objectIntegrityProofs",
+						keyId: signer.keyId
+					}];
+				});
+			} else originAuthenticated = fetched.actorIds.map((actorId) => ({
+				kind: "actor",
+				id: actorId,
+				mechanism: "origin",
+				keyId: null
+			}));
+		} else {
+			logger.debug("Object Integrity Proofs are verified.", {
+				recipient,
+				activity: json
+			});
+			activity = verified.object;
+			documentSigners = verified.signers.map((signer) => ({
+				kind: signer.kind,
+				id: signer.id,
+				mechanism: "objectIntegrityProofs",
+				keyId: signer.keyId
+			}));
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document,
+				baseUrl: null
+			};
+		}
 		if (activity.actorId == null) {
 			logger.debug("Activity is missing an actor; unable to verify.", {
 				recipient,
@@ -7844,10 +8193,21 @@ var ContextImpl = class ContextImpl {
 			});
 			return false;
 		}
+		const view = fetchedView ?? await buildVerifiedActivityView(snapshot, viewSource);
 		const routeResult = await routeActivity({
 			context: this,
 			json,
 			ldSignatureVerified: false,
+			authentication: createAuthenticationEvidence({
+				verified: true,
+				requestSigners: [],
+				documentSigners,
+				originAuthenticated,
+				expandedActivity: deepFreeze(view.expanded),
+				baseUrl: viewSource.baseUrl
+			}),
+			verifiedView: view.view,
+			replayable: view.replayable,
 			activity,
 			recipient,
 			inboxListeners: this.federation.inboxListeners,
@@ -8198,12 +8558,14 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 	activity;
 	activityId;
 	activityType;
-	constructor(recipient, activity, activityId, activityType, options) {
+	authentication;
+	constructor(recipient, activity, activityId, activityType, options, authentication) {
 		super(options);
 		this.recipient = recipient;
 		this.activity = activity;
 		this.activityId = activityId;
 		this.activityType = activityType;
+		this.authentication = authentication ?? getEmptyAuthenticationEvidence();
 	}
 	clone(data) {
 		return new InboxContextImpl(this.recipient, this.activity, this.activityId, this.activityType, {
@@ -8213,7 +8575,7 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, this.authentication);
 	}
 	forwardActivity(forwarder, recipients, options) {
 		return forwardActivity(this, "inbox", forwarder, recipients, options).then(() => void 0);