@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2448

package/dist/{federation-BVH7drJA.cjs → federation-D8YexkP1.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-BfW3wyQ4.cjs");
+const require_http = require("./http-CAl7Num5.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-C-Z1SKDy.cjs");
-const require_kv_cache = require("./kv-cache-kkBB0vbI.cjs");
+const require_portable_collection = require("./portable-collection-TC-kvkVI.cjs");
+const require_kv_cache = require("./kv-cache-CjgCOz3i.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -15,6 +15,8 @@ let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
 let es_toolkit = require("es-toolkit");
+let json_canon = require("json-canon");
+json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 let _fedify_webfinger = require("@fedify/webfinger");
 let _opentelemetry_sdk_metrics = require("@opentelemetry/sdk-metrics");
@@ -32,9 +34,12 @@ var ActivityListenerSet = class {
 		clone.#listeners = new Map(this.#listeners);
 		return clone;
 	}
-	add(type, listener) {
+	add(type, listener, options = {}) {
 		if (this.#listeners.has(type)) throw new TypeError("Listener already set for this type.");
-		this.#listeners.set(type, listener);
+		this.#listeners.set(type, {
+			listener,
+			options: { ...options }
+		});
 	}
 	dispatchWithClass(activity) {
 		let cls = activity.constructor;
@@ -44,10 +49,11 @@ var ActivityListenerSet = class {
 			cls = globalThis.Object.getPrototypeOf(cls);
 		}
 		if (cls == null) return null;
-		const listener = this.#listeners.get(cls);
+		const { listener, options } = this.#listeners.get(cls);
 		return {
 			class: cls,
-			listener
+			listener,
+			options
 		};
 	}
 	dispatch(activity) {
@@ -635,8 +641,8 @@ var FederationBuilderImpl = class {
 		}
 		const listeners = this.inboxListeners = new ActivityListenerSet();
 		const setters = {
-			on(type, listener) {
-				listeners.add(type, listener);
+			on(type, listener, options) {
+				listeners.add(type, listener, options);
 				return setters;
 			},
 			onError: (handler) => {
@@ -2805,6 +2811,172 @@ async function isInAudience(object, actor, options = {}) {
 	return false;
 }
 //#endregion
+//#region src/federation/inbox-authentication.ts
+/**
+* The evidence of an activity that has not been authenticated by Fedify.
+*/
+const EMPTY_EVIDENCE = Object.freeze({
+	verified: false,
+	requestSigners: Object.freeze([]),
+	documentSigners: Object.freeze([]),
+	originAuthenticated: Object.freeze([]),
+	expandedActivity: Object.freeze([]),
+	baseUrl: null
+});
+/**
+* Gets the evidence of an activity that has not been authenticated.
+* @internal
+*/
+function getEmptyAuthenticationEvidence() {
+	return EMPTY_EVIDENCE;
+}
+/**
+* Gets the principals that an authorization decision should rely on.
+* @param evidence The evidence.
+* @param scope See {@link IsActorAuthenticatedOptions.scope}.
+* @returns The principals.
+* @internal
+*/
+function getEffectivePrincipals(evidence, scope = "effective") {
+	if (scope === "document" || evidence.documentSigners.length > 0) return evidence.documentSigners;
+	if (evidence.requestSigners.length > 0) return evidence.requestSigners;
+	return evidence.originAuthenticated;
+}
+/**
+* Normalizes an actor ID for comparison: portable IDs and compatible
+* identifiers to their canonical portable ID, other IDs to their `href`.
+* @returns The normalized ID, or `null` for a malformed portable ID.
+*/
+function normalizeActorId(id) {
+	return require_http.isPortableId(id) ? require_http.getCanonicalPortableId(id) : id.href;
+}
+/**
+* Checks whether the given principal authenticates the given actor.
+* @param principal The principal.
+* @param actorId The actor ID.
+* @returns `true` if the principal authenticates the actor.
+* @internal
+*/
+function principalAuthenticates(principal, actorId) {
+	if (principal.kind === "portableAuthority") {
+		if (!require_http.isPortableId(actorId)) return false;
+		const did = require_http.getPortableDid(actorId);
+		return did != null && did === require_http.getPortableDid(principal.id);
+	}
+	const expected = normalizeActorId(actorId);
+	return expected != null && normalizeActorId(principal.id) === expected;
+}
+/**
+* Checks whether the given evidence authenticates the given actor.
+*
+* Actor IDs are compared exactly, except that [FEP-ef61] portable IDs and
+* compatible identifiers are compared by their canonical portable IDs, and
+* a portable authority (a DID) authenticates the portable actors of that DID.
+*
+* @example
+* ``` typescript
+* federation
+*   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+*   .on(Follow, async (ctx, follow) => {
+*     if (follow.actorId == null) return;
+*     // The actor is always authenticated for activities that declare one,
+*     // but the same check works for any actor an activity names:
+*     isActorAuthenticated(ctx.authentication, follow.actorId);
+*   });
+* ```
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param evidence The authentication evidence, usually
+*                 {@link InboxContext.authentication}.
+* @param actorId The actor ID to check.
+* @param options Options.
+* @returns `true` if the actor is authenticated.
+* @since 2.5.0
+*/
+function isActorAuthenticated(evidence, actorId, options = {}) {
+	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
+}
+function serializePrincipal(principal) {
+	return {
+		kind: principal.kind,
+		id: principal.id.href,
+		mechanism: principal.mechanism,
+		keyId: principal.keyId?.href ?? null
+	};
+}
+/**
+* Serializes the principals of the given evidence for a queued message.
+* @internal
+*/
+function serializeAuthentication(evidence) {
+	return {
+		verified: evidence.verified,
+		requestSigners: evidence.requestSigners.map(serializePrincipal),
+		documentSigners: evidence.documentSigners.map(serializePrincipal),
+		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
+	};
+}
+const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
+const MECHANISMS = /* @__PURE__ */ new Set([
+	"httpSignatures",
+	"linkedDataSignatures",
+	"objectIntegrityProofs",
+	"origin"
+]);
+function deserializePrincipals(value) {
+	if (!Array.isArray(value)) return null;
+	const principals = [];
+	for (const item of value) {
+		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		principals.push(Object.freeze({
+			kind: item.kind,
+			id: new URL(item.id),
+			mechanism: item.mechanism,
+			keyId: item.keyId == null ? null : new URL(item.keyId)
+		}));
+	}
+	return principals;
+}
+/**
+* Restores the evidence of a queued message.
+* @param value The serialized principals.
+* @param expandedActivity The expanded activity, restored from the queued
+*                         verified view.
+* @param baseUrl The base URL, restored from the queued verified view.
+* @returns The evidence, or `null` if the serialized value is malformed.
+* @internal
+*/
+function deserializeAuthentication(value, expandedActivity, baseUrl) {
+	if (value == null || typeof value !== "object" || typeof value.verified !== "boolean") return null;
+	const record = value;
+	const requestSigners = deserializePrincipals(record.requestSigners);
+	const documentSigners = deserializePrincipals(record.documentSigners);
+	const originAuthenticated = deserializePrincipals(record.originAuthenticated);
+	if (requestSigners == null || documentSigners == null || originAuthenticated == null) return null;
+	return createAuthenticationEvidence({
+		verified: record.verified,
+		requestSigners,
+		documentSigners,
+		originAuthenticated,
+		expandedActivity,
+		baseUrl
+	});
+}
+/**
+* Creates frozen evidence.
+* @internal
+*/
+function createAuthenticationEvidence(evidence) {
+	return Object.freeze({
+		verified: evidence.verified,
+		requestSigners: Object.freeze([...evidence.requestSigners]),
+		documentSigners: Object.freeze([...evidence.documentSigners]),
+		originAuthenticated: Object.freeze([...evidence.originAuthenticated]),
+		expandedActivity: evidence.expandedActivity,
+		baseUrl: evidence.baseUrl
+	});
+}
+//#endregion
 //#region src/federation/inbox.ts
 const Temporal$10 = require_http.Temporal;
 /**
@@ -2827,13 +2999,135 @@ function actorsHaveSameOrigin(activity) {
 	const origin = require_http.getAuthenticationOrigin(activity.id);
 	return origin != null && activity.actorIds.every((actor) => require_http.getAuthenticationOrigin(actor) === origin);
 }
-async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
+/**
+* The headroom that the size check of a queued inbox message leaves for the
+* fields that grow when Fedify retries the message, e.g., its attempt count.
+*/
+const QUEUED_MESSAGE_HEADROOM = 64;
+/**
+* Computes the idempotency key of an incoming activity.
+* @returns The key, or `null` if the activity is not deduplicated.
+* @internal
+*/
+async function getInboxIdempotencyKey(strategy, inboxContext, activity, origin, recipient, prefix) {
+	if (activity.id == null) return null;
+	strategy ??= "per-inbox";
+	let keyString;
+	if (typeof strategy === "function") keyString = await strategy(inboxContext(), activity);
+	else switch (strategy) {
+		case "global":
+			keyString = activity.id.href;
+			break;
+		case "per-origin":
+			keyString = `${origin}\n${activity.id.href}`;
+			break;
+		case "per-inbox":
+			keyString = `${origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
+			break;
+		default: keyString = `${origin}\n${activity.id.href}`;
+	}
+	return keyString == null ? null : [...prefix, keyString];
+}
+/**
+* Checks whether an incoming activity has already been processed, by its
+* idempotency key, or by the key that queue workers of older versions of
+* Fedify recorded.
+* @internal
+*/
+async function isInboxActivityProcessed(kv, cacheKey, activity, origin, prefix) {
+	if (cacheKey == null) return false;
+	if (await kv.get(cacheKey) === true) return true;
+	if (activity.id == null) return false;
+	return await kv.get([
+		...prefix,
+		origin,
+		activity.id.href
+	]) === true;
+}
+/**
+* The bytes added to the UTF-8 JSON length of a message for each of its JSON
+* values, to bound the size of serialization formats other than JSON, such
+* as the structured serialization of Deno KV, which spends more bytes than
+* JSON on type tags and lengths of small values, e.g., empty arrays, and up
+* to nine bytes on a fractional number that JSON writes in three.
+*/
+const PER_VALUE_SERIALIZATION_OVERHEAD = 8;
+/**
+* Estimates, conservatively, how large a queued message is once a queue
+* backend serializes it: the UTF-8 length of its JSON serialization, plus
+* a fixed overhead for each JSON value in it, plus the bytes that encoding
+* strings beyond Latin-1 as UTF-16 adds.
+* @internal
+*/
+function estimateQueuedMessageSize(message) {
+	const encoder = new TextEncoder();
+	let values = 0;
+	let stringExpansion = 0;
+	const countString = (value) => {
+		values++;
+		if (!/[\u0100-\uffff]/.test(value)) return;
+		const expansion = value.length * 2 - encoder.encode(value).byteLength;
+		if (expansion > 0) stringExpansion += expansion;
+	};
+	const count = (value) => {
+		if (typeof value === "string") {
+			countString(value);
+			return;
+		}
+		values++;
+		if (Array.isArray(value)) for (const item of value) count(item);
+		else if (value != null && typeof value === "object") for (const [key, item] of Object.entries(value)) {
+			if (item === void 0) continue;
+			countString(key);
+			count(item);
+		}
+	};
+	count(message);
+	return encoder.encode(JSON.stringify(message)).byteLength + stringExpansion + values * PER_VALUE_SERIALIZATION_OVERHEAD;
+}
+/**
+* Checks whether an activity that declares no actor is authenticated: at
+* least one principal must be authenticated for it, and its ID, if any, must
+* have the same [FEP-fe34] origin as one of those principals.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @returns `"ok"` if it is authenticated, or why it is not.
+* @internal
+*/
+function checkActorlessActivity(activity, authentication) {
+	const principals = getEffectivePrincipals(authentication);
+	if (principals.length < 1) return {
+		status: "noAuthenticatedPrincipal",
+		principals
+	};
+	if (activity.id == null) return {
+		status: "ok",
+		principals
+	};
+	const origin = require_http.getAuthenticationOrigin(activity.id);
+	if (origin == null || !principals.some((principal) => require_http.getAuthenticationOrigin(principal.id) === origin)) return {
+		status: "activityOriginMismatch",
+		principals
+	};
+	return {
+		status: "ok",
+		principals
+	};
+}
+/**
+* Same as {@link checkActorlessActivity}, but returns a boolean.
+* @internal
+*/
+function isActorlessActivityAuthenticated(activity, authentication) {
+	return checkActorlessActivity(activity, authentication).status === "ok";
+}
+async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, authentication, verifiedView, replayable, actorless, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
-	if (activity.actorId == null) {
+	if (activity.actorId == null && !actorless) {
 		logger.error("Missing actor.", { activity: json });
 		span.setStatus({
 			code: _opentelemetry_api.SpanStatusCode.ERROR,
@@ -2842,58 +3136,59 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 		require_http.recordInboxActivity(meterProvider, "rejected", (0, _fedify_vocab.getTypeId)(activity).href);
 		return "missingActor";
 	}
-	let cacheKey = null;
-	if (activity.id != null) {
-		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href);
-		const strategy = idempotencyStrategy ?? "per-inbox";
-		let keyString;
-		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
-		else switch (strategy) {
-			case "global":
-				keyString = activity.id.href;
-				break;
-			case "per-origin":
-				keyString = `${ctx.origin}\n${activity.id.href}`;
-				break;
-			case "per-inbox":
-				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
-				break;
-			default: keyString = `${ctx.origin}\n${activity.id.href}`;
-		}
-		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
+	const contextMetadata = { authentication };
+	const cacheKey = await getInboxIdempotencyKey(idempotencyStrategy, () => inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href, contextMetadata), activity, ctx.origin, recipient, kvPrefixes.activityIdempotence);
+	if (await isInboxActivityProcessed(kv, cacheKey, activity, ctx.origin, kvPrefixes.activityIdempotence)) {
+		logger.debug("Activity {activityId} has already been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.UNSET,
+			message: `Activity ${activity.id?.href} has already been processed.`
+		});
+		require_http.recordInboxActivity(meterProvider, "rejected", (0, _fedify_vocab.getTypeId)(activity).href);
+		return "alreadyProcessed";
 	}
-	if (cacheKey != null) {
-		if (await kv.get(cacheKey) === true) {
-			logger.debug("Activity {activityId} has already been processed.", {
+	if (activity.actorId != null) span.setAttribute("activitypub.actor.id", activity.actorId.href);
+	let message;
+	if (queue != null) {
+		const carrier = {};
+		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+		message = {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: ctx.origin,
+			activity: originalJson ?? json,
+			...normalizedActivity == null ? {} : { normalizedActivity },
+			...ldSignatureVerified == null ? {} : { ldSignatureVerified },
+			...verifiedView == null ? {} : { verifiedView },
+			...authentication == null ? {} : { authentication: serializeAuthentication(authentication) },
+			identifier: recipient,
+			attempt: 0,
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			traceContext: carrier
+		};
+		const maxMessageSize = queue.maxMessageSize;
+		if (replayable === false) {
+			logger.warn("The incoming activity {activityId} uses a JSON-LD context that cannot be kept for the queue; processing it immediately instead.", {
 				activityId: activity.id?.href,
-				activity: json,
 				recipient
 			});
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.UNSET,
-				message: `Activity ${activity.id?.href} has already been processed.`
+			message = void 0;
+		} else if (maxMessageSize != null && estimateQueuedMessageSize(message) > maxMessageSize - QUEUED_MESSAGE_HEADROOM) {
+			logger.warn("The incoming activity {activityId} is too large to enqueue; processing it immediately instead.", {
+				activityId: activity.id?.href,
+				recipient,
+				maxMessageSize
 			});
-			require_http.recordInboxActivity(meterProvider, "rejected", (0, _fedify_vocab.getTypeId)(activity).href);
-			return "alreadyProcessed";
+			message = void 0;
 		}
 	}
-	span.setAttribute("activitypub.actor.id", activity.actorId.href);
-	if (queue != null) {
-		const carrier = {};
-		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+	if (queue != null && message != null) {
 		try {
-			await queue.enqueue({
-				type: "inbox",
-				id: crypto.randomUUID(),
-				baseUrl: ctx.origin,
-				activity: originalJson ?? json,
-				...normalizedActivity == null ? {} : { normalizedActivity },
-				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
-				identifier: recipient,
-				attempt: 0,
-				started: (/* @__PURE__ */ new Date()).toISOString(),
-				traceContext: carrier
-			});
+			await queue.enqueue(message);
 		} catch (error) {
 			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
 				error,
@@ -2943,7 +3238,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			const started = performance.now();
 			try {
 				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
-				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType), activity);
+				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType, contextMetadata), activity);
 			} finally {
 				require_http.getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, require_http.getDurationMs(started));
 			}
@@ -2984,6 +3279,382 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
+//#region src/federation/inbox-view.ts
+/**
+* The interpretation of an incoming activity that Fedify authenticated, kept
+* so that listeners, authorization helpers, and queue workers observe the
+* same JSON-LD meaning that signature verification observed.
+*
+* Every JSON-LD processing step of one delivery goes through a request-scoped
+* *context snapshot*, which memoizes the remote context responses so that
+* a nondeterministic or mutable remote context cannot give verification and
+* dispatch different meanings.  The snapshot is serialized into queued
+* messages, so that workers and retries replay the very same responses
+* without loading contexts again.
+* @module
+*/
+/**
+* Thrown when replaying an interpretation needs a context response that its
+* snapshot does not have, or has with a different content.
+* @internal
+*/
+var ContextSnapshotMissError = class extends Error {
+	url;
+	constructor(url, reason) {
+		super(`Context ${url} cannot be replayed: ${reason}.`);
+		this.name = "ContextSnapshotMissError";
+		this.url = url;
+	}
+};
+function normalizeUrl(url) {
+	return URL.canParse(url) ? new URL(url).href : url;
+}
+/**
+* Creates the context snapshot of a delivery.
+* @param base The caller's context loader.
+* @returns The snapshot.
+* @internal
+*/
+function createContextSnapshot(base) {
+	const underlying = {
+		standard: require_http.wrapContextLoaderForJsonLd(base),
+		normalization: require_http.getNormalizationContextLoader(base)
+	};
+	const cache = /* @__PURE__ */ new Map();
+	const recorded = /* @__PURE__ */ new Map();
+	const loaders = /* @__PURE__ */ new Map();
+	let released = false;
+	return {
+		loader(policy) {
+			let loader = loaders.get(policy);
+			if (loader != null) return loader;
+			const effective = underlying[policy];
+			loader = require_http.markEffectiveContextLoader(async (url, options) => {
+				if (released) return await effective(url, options);
+				const normalizedUrl = normalizeUrl(url);
+				const key = `${policy}\n${normalizedUrl}`;
+				let promise = cache.get(key);
+				if (promise == null) {
+					promise = Promise.resolve(effective(url, options)).then((response) => {
+						const cloned = normalizeResponse(structuredClone(response));
+						recorded.set(key, {
+							policy,
+							url: normalizedUrl,
+							response: structuredClone(cloned)
+						});
+						return cloned;
+					});
+					promise.catch(() => {});
+					cache.set(key, promise);
+				}
+				return structuredClone(await promise);
+			}, policy);
+			loaders.set(policy, loader);
+			return loader;
+		},
+		entries() {
+			return [...recorded.values()];
+		},
+		release() {
+			released = true;
+		}
+	};
+}
+function getBundledResponse(url) {
+	if (!(url in _fedify_vocab_runtime.preloadedContexts)) return null;
+	return {
+		contextUrl: null,
+		document: _fedify_vocab_runtime.preloadedContexts[url],
+		documentUrl: url
+	};
+}
+async function sha256(value) {
+	return (0, byte_encodings_hex.encodeHex)(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, json_canon.default)(value))));
+}
+function normalizeResponse(response) {
+	return {
+		contextUrl: response.contextUrl ?? null,
+		document: response.document,
+		documentUrl: response.documentUrl
+	};
+}
+/**
+* Serializes the entries of a context snapshot for a queued message.
+* @param entries The entries.
+* @returns The serialized entries, which are plain JSON values.
+* @internal
+*/
+async function serializeContextSnapshot(entries) {
+	const result = [];
+	for (const entry of entries) {
+		const response = normalizeResponse(entry.response);
+		const hash = await sha256(response);
+		const bundled = getBundledResponse(entry.url);
+		if (bundled != null && await sha256(bundled) === hash) result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			bundled: true
+		});
+		else result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+function isRemoteDocument(value) {
+	if (value == null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.documentUrl === "string" && "document" in record && (record.contextUrl == null || typeof record.contextUrl === "string");
+}
+/**
+* Restores the entries of a serialized context snapshot, verifying the
+* hashes of stored responses.  Bundled entries are reconstructed from the
+* contexts this version of Fedify bundles.
+* @param entries The serialized entries.
+* @returns The entries.
+* @throws {ContextSnapshotMissError} If an entry is malformed, or its
+*                                    content does not match its hash.
+* @internal
+*/
+async function deserializeContextSnapshot(entries) {
+	if (!Array.isArray(entries)) throw new ContextSnapshotMissError("(snapshot)", "malformed snapshot");
+	const result = [];
+	for (const entry of entries) {
+		if (entry == null || typeof entry !== "object" || entry.policy !== "standard" && entry.policy !== "normalization" || typeof entry.url !== "string" || typeof entry.sha256 !== "string") throw new ContextSnapshotMissError("(snapshot)", "malformed entry");
+		let response;
+		if (entry.bundled === true) {
+			response = getBundledResponse(entry.url);
+			if (response == null) throw new ContextSnapshotMissError(entry.url, "not bundled");
+		} else if (isRemoteDocument(entry.response)) response = normalizeResponse(entry.response);
+		else throw new ContextSnapshotMissError(entry.url, "malformed entry");
+		if (entry.bundled !== true && await sha256(response) !== entry.sha256) throw new ContextSnapshotMissError(entry.url, "content mismatch");
+		result.push({
+			policy: entry.policy,
+			url: entry.url,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+/**
+* Creates a context loader of a policy that serves only the responses of
+* a snapshot.  It is marked as the effective loader of the policy.
+* @param entries The snapshot's entries.
+* @param policy The policy.
+* @returns The loader, which throws {@link ContextSnapshotMissError} for
+*          anything else.
+* @internal
+*/
+function createSnapshotOnlyLoader(entries, policy) {
+	const responses = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (entry.policy === policy) responses.set(entry.url, entry.response);
+	return require_http.markEffectiveContextLoader(async (url) => {
+		const response = responses.get(normalizeUrl(url));
+		if (response == null) throw new ContextSnapshotMissError(url, "not in the snapshot");
+		return structuredClone(response);
+	}, policy);
+}
+/**
+* Creates a {@link ReleasableLoader}.
+* @param strict The loader to use until release.
+* @param fallback The loader to use after release.
+* @param policy The policy both loaders apply.
+* @returns The releasable loader.
+* @internal
+*/
+function createReleasableLoader(strict, fallback, policy) {
+	let released = false;
+	return {
+		loader: require_http.markEffectiveContextLoader((url, options) => released ? fallback(url, options) : strict(url, options), policy),
+		release() {
+			released = true;
+		}
+	};
+}
+/**
+* Expands a JSON-LD document with the given context loader.
+* @param document The document.
+* @param contextLoader The context loader.
+* @returns The expanded document.
+* @internal
+*/
+async function expandDocument(document, contextLoader) {
+	return await _fedify_vocab_runtime_jsonld.default.expand(document, { documentLoader: contextLoader });
+}
+/**
+* Computes the digest of an expanded document.
+* @param expanded The expanded document.
+* @returns The hex-encoded SHA-256 of its canonical JSON.
+* @internal
+*/
+function digestExpandedDocument(expanded) {
+	return sha256(expanded);
+}
+/**
+* Deeply freezes a JSON value.
+* @param value The value.
+* @returns The same value, frozen.
+* @internal
+*/
+function deepFreeze(value) {
+	if (value != null && typeof value === "object" && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
+const ACTOR_IRI = "https://www.w3.org/ns/activitystreams#actor";
+/**
+* Gets the single root node of an expanded document.
+* @param expanded The expanded document.
+* @returns The root node, or `null` if there is not exactly one.
+* @internal
+*/
+function getRootNode(expanded) {
+	if (expanded.length !== 1) return null;
+	const node = expanded[0];
+	if (node == null || typeof node !== "object" || Array.isArray(node)) return null;
+	return node;
+}
+/**
+* Gets the values of a property of an expanded node, unwrapping a single
+* `@list` container the way generated vocabulary decoders do.
+* @param node The expanded node.
+* @param iri The property IRI.
+* @returns The values, or an empty array if the property is absent.
+* @internal
+*/
+function getPropertyValues(node, iri) {
+	const values = node[iri];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return [values];
+	if (values.length === 1 && values[0] != null && typeof values[0] === "object" && "@list" in values[0]) {
+		const list = values[0]["@list"];
+		return Array.isArray(list) ? list : [list];
+	}
+	return values;
+}
+/**
+* Tells whether the root node of an expanded activity declares any `actor`
+* value at all, including blank nodes, anonymous or untyped nodes, and
+* literals, which ID accessors and typed parsing may drop.
+* @param expanded The expanded activity.
+* @returns `"absent"` if the root node declares no actor; `"present"`
+*          otherwise, including when there is no single root node.
+* @internal
+*/
+function getActorPresence(expanded) {
+	const root = getRootNode(expanded);
+	if (root == null) return "present";
+	return getPropertyValues(root, ACTOR_IRI).length < 1 ? "absent" : "present";
+}
+/**
+* Builds the serialized view of an authenticated activity.  The document is
+* expanded through the snapshot, so that the snapshot holds every context
+* response the interpretation needs.
+* @param snapshot The delivery's context snapshot.
+* @param source Which document the activity was parsed from.
+* @returns The serialized view and the expanded activity.
+* @internal
+*/
+async function buildVerifiedActivityView(snapshot, source) {
+	const loader = snapshot.loader(source.policy);
+	const used = /* @__PURE__ */ new Set();
+	const expanded = await expandDocument(source.document, require_http.markEffectiveContextLoader((url, options) => {
+		used.add(normalizeUrl(url));
+		return loader(url, options);
+	}, source.policy));
+	const entries = snapshot.entries().filter((entry) => entry.policy === source.policy && used.has(entry.url));
+	const contexts = await serializeContextSnapshot(entries);
+	const references = /* @__PURE__ */ new Set();
+	collectContextReferences(source.document, source.baseUrl?.href, references);
+	for (const entry of entries) {
+		const { contextUrl, document } = entry.response;
+		collectContextReferences(document, entry.url, references);
+		if (contextUrl != null) collectContextReferences({ "@context": contextUrl }, entry.url, references);
+	}
+	return {
+		replayable: [...references].every((url) => used.has(url)),
+		view: {
+			version: 1,
+			policy: source.policy,
+			source: source.source,
+			baseUrl: source.baseUrl?.href ?? null,
+			contexts,
+			expandedDigest: await digestExpandedDocument(expanded)
+		},
+		expanded
+	};
+}
+/**
+* Collects the remote context references of a JSON-LD document or context
+* document: every IRI given as a value of `@context` at any depth, including
+* scoped contexts of term definitions, and of `@import`.
+* @param value The document.
+* @param base The URL to resolve relative references against.
+* @param references The set to add the normalized references to.
+*/
+function collectContextReferences(value, base, references) {
+	const add = (reference) => {
+		let url = reference;
+		if (base != null && URL.canParse(reference, base)) url = new URL(reference, base).href;
+		references.add(normalizeUrl(url));
+	};
+	const collectContext = (context) => {
+		if (typeof context === "string") add(context);
+		else if (Array.isArray(context)) for (const item of context) collectContext(item);
+		else if (context != null && typeof context === "object") {
+			const imported = context["@import"];
+			if (typeof imported === "string") add(imported);
+			walk(context);
+		}
+	};
+	const walk = (node) => {
+		if (Array.isArray(node)) for (const item of node) walk(item);
+		else if (node != null && typeof node === "object") for (const [key, item] of Object.entries(node)) if (key === "@context") collectContext(item);
+		else walk(item);
+	};
+	walk(value);
+}
+/**
+* Validates the shape of a serialized view taken from a queued message.
+* @param value The value of the message's `verifiedView` field.
+* @returns The view, or `null` if it is malformed or of an unsupported
+*          version.
+* @internal
+*/
+function parseSerializedVerifiedActivityView(value) {
+	if (value == null || typeof value !== "object") return null;
+	const view = value;
+	if (view.version !== 1 || view.policy !== "standard" && view.policy !== "normalization" || view.source !== "activity" && view.source !== "normalizedActivity" || view.baseUrl !== null && (typeof view.baseUrl !== "string" || !URL.canParse(view.baseUrl)) || !Array.isArray(view.contexts) || typeof view.expandedDigest !== "string") return null;
+	return view;
+}
+/**
+* Restores a view from a queued message without loading any context.
+* @param view The serialized view.
+* @param message The fields of the message the view refers to.
+* @returns The restored view.
+* @throws {ContextSnapshotMissError} If the view cannot be replayed exactly.
+* @internal
+*/
+async function restoreVerifiedActivityView(view, message) {
+	const loader = createSnapshotOnlyLoader(await deserializeContextSnapshot(view.contexts), view.policy);
+	if (view.source === "normalizedActivity" && message.normalizedActivity == null) throw new ContextSnapshotMissError("(normalizedActivity)", "the normalized activity is missing");
+	const document = require_http.detachSignature(view.source === "activity" ? message.activity : message.normalizedActivity);
+	const expanded = await expandDocument(document, loader);
+	if (await digestExpandedDocument(expanded) !== view.expandedDigest) throw new ContextSnapshotMissError("(activity)", "the interpretation does not match the authenticated one");
+	return {
+		document,
+		loader,
+		expanded,
+		baseUrl: view.baseUrl == null ? null : new URL(view.baseUrl)
+	};
+}
+//#endregion
 //#region src/federation/keycache.ts
 const Temporal$9 = require_http.Temporal;
 const KEY_CACHE_GENERATION = "3";
@@ -5405,11 +6076,12 @@ async function handleInbox(request, options) {
 	}, async (span) => {
 		if (options.recipient != null) span.setAttribute("fedify.inbox.recipient", options.recipient);
 		const spanContext = span.spanContext();
+		const snapshot = createContextSnapshot(options.context.contextLoader);
 		try {
 			return await (0, _logtape_logtape.withContext)({
 				traceId: spanContext.traceId,
 				spanId: spanContext.spanId
-			}, () => handleInboxInternal(request, options, span));
+			}, () => handleInboxInternal(request, options, span, snapshot));
 		} catch (e) {
 			options.observation.hasException = true;
 			span.setStatus({
@@ -5418,6 +6090,7 @@ async function handleInbox(request, options) {
 			});
 			throw e;
 		} finally {
+			snapshot.release();
 			options.observation.project(span);
 			span.end();
 		}
@@ -5429,9 +6102,10 @@ async function handleInbox(request, options) {
 * @param request The HTTP request.
 * @param options The parameters for handling the inbox.
 * @param span The OpenTelemetry span for tracing.
+* @param snapshot The context snapshot of the delivery.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleInboxInternal(request, parameters, span) {
+async function handleInboxInternal(request, parameters, span, snapshot) {
 	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const observation = parameters.observation;
 	const signatureObservation = { [require_http.verificationObservation]: observation.verification };
@@ -5545,6 +6219,8 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		keyTtl: publicKeyTtl
 	});
+	const standardLoader = snapshot.loader("standard");
+	const normalizationLoader = snapshot.loader("normalization");
 	const jsonWithoutSig = require_http.detachSignature(json);
 	const hasLdSignature = require_http.hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -5580,9 +6256,10 @@ async function handleInboxInternal(request, parameters, span) {
 	let compactedJson = json;
 	let compactedJsonWithoutSig = jsonWithoutSig;
 	let ldSigVerified = false;
+	let ldSigKey = null;
 	if (hasLdSignature) {
 		try {
-			compactedJson = await require_http.compactJsonLd(json, ctx.contextLoader);
+			compactedJson = await require_http.compactJsonLd(json, normalizationLoader);
 		} catch (error) {
 			if (isInvalidJsonLdError(error)) {
 				logger.error("Failed to parse JSON-LD:\n{error}", {
@@ -5618,16 +6295,18 @@ async function handleInboxInternal(request, parameters, span) {
 		if (compactedJson !== json) {
 			compactedJsonWithoutSig = require_http.detachSignature(compactedJson);
 			try {
-				ldSigVerified = await require_http.verifyCompactJsonLd(compactedJson, {
+				const ldResult = await require_http.verifyCompactJsonLdDetailed(compactedJson, {
 					...signatureObservation,
-					contextLoader: ctx.contextLoader,
+					contextLoader: normalizationLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
 					meterProvider,
 					tracerProvider
 				});
+				ldSigVerified = ldResult.verified;
+				ldSigKey = ldResult.key;
 			} catch (error) {
-				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 				if (isInvalidJsonLdError(error)) {
 					logger.error("Failed to parse JSON-LD:\n{error}", {
 						recipient,
@@ -5645,12 +6324,12 @@ async function handleInboxInternal(request, parameters, span) {
 				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 				if (!skipSignatureVerification) try {
 					await _fedify_vocab.Object.fromJsonLd(compactedJson, {
-						contextLoader: require_http.getNormalizationContextLoader(ctx.contextLoader),
+						contextLoader: normalizationLoader,
 						documentLoader: ctx.documentLoader,
 						tracerProvider
 					});
 				} catch (parseError) {
-					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(parseError);
+					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(parseError);
 					if (isInvalidJsonLdError(parseError)) {
 						logger.error("Failed to parse JSON-LD:\n{error}", {
 							recipient,
@@ -5674,6 +6353,33 @@ async function handleInboxInternal(request, parameters, span) {
 	let activity = null;
 	let activityVerified = false;
 	let proofVerified = false;
+	let documentSigners = [];
+	let requestSigners = [];
+	let viewSource;
+	const rawViewSource = {
+		policy: "standard",
+		source: "activity",
+		document: jsonWithoutSig,
+		baseUrl: null
+	};
+	const isActorlessCandidate = async (candidate, source) => {
+		if (skipSignatureVerification) return false;
+		if (inboxListeners?.dispatchWithClass(candidate)?.options.allowActorless !== true) return false;
+		try {
+			return getActorPresence(await expandDocument(source.document, snapshot.loader(source.policy))) === "absent";
+		} catch {
+			return false;
+		}
+	};
+	const verifyProofs = (contextLoader = standardLoader) => require_http.verifyObjectDetailed(_fedify_vocab.Activity, jsonWithoutSig, {
+		...signatureObservation,
+		contextLoader,
+		documentLoader: ctx.documentLoader,
+		keyCache,
+		meterProvider,
+		tracerProvider,
+		verifyPortableObject: ctx.verifyPortableObject
+	});
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -5682,18 +6388,49 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await _fedify_vocab.Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
-				contextLoader: require_http.getNormalizationContextLoader(ctx.contextLoader)
+				contextLoader: normalizationLoader
 			});
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		viewSource = {
+			policy: "normalization",
+			source: "normalizedActivity",
+			document: compactedJsonWithoutSig,
+			baseUrl: null
+		};
+		if (ldSigKey?.ownerId != null) documentSigners = [{
+			kind: "actor",
+			id: ldSigKey.ownerId,
+			mechanism: "linkedDataSignatures",
+			keyId: ldSigKey.id
+		}];
+		if (await isActorlessCandidate(activity, viewSource)) {
+			let result = null;
+			try {
+				result = await verifyProofs();
+			} catch (error) {
+				if (!isPermanentActivityParseError(error)) throw error;
+				logger.debug("Failed to verify the Object Integrity Proofs of the activity without an actor:\n{error}", {
+					recipient,
+					error
+				});
+			}
+			if (result?.status === "unavailable") throw result.error;
+			if (result?.status === "verified" && result.signers.length > 0) {
+				activity = observation.activity = result.object;
+				documentSigners = toProofPrincipals(result.signers);
+				viewSource = rawViewSource;
+				proofVerified = true;
+			}
+		}
 		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
 				...signatureObservation,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -5711,18 +6448,11 @@ async function handleInboxInternal(request, parameters, span) {
 			recipient,
 			json
 		});
+		let proofResult;
 		try {
-			activity = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
-				...signatureObservation,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
-				documentLoader: ctx.documentLoader,
-				keyCache,
-				meterProvider,
-				tracerProvider,
-				verifyPortableObject: ctx.verifyPortableObject
-			});
+			proofResult = await verifyProofs();
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, standardLoader)) return await respondInvalidActivity(error);
 			if (deferredLdSignatureError != null) {
 				logger.debug("Object Integrity Proof fallback did not supersede a deferred Linked Data Signature failure:\n{error}", {
 					recipient,
@@ -5758,6 +6488,22 @@ async function handleInboxInternal(request, parameters, span) {
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
 			});
 		}
+		if (proofResult.status === "verified") if (proofResult.signers.length < 1 && await isActorlessCandidate(proofResult.object, rawViewSource)) activity = null;
+		else {
+			activity = proofResult.object;
+			documentSigners = toProofPrincipals(proofResult.signers);
+			viewSource = rawViewSource;
+		}
+		else if (proofResult.status === "unavailable") {
+			let parsed = null;
+			try {
+				parsed = await _fedify_vocab.Activity.fromJsonLd(jsonWithoutSig, {
+					...ctx,
+					contextLoader: standardLoader
+				});
+			} catch {}
+			if (parsed != null && await isActorlessCandidate(parsed, rawViewSource)) throw proofResult.error;
+		}
 		if (activity == null) logger.debug("Object Integrity Proofs are not verified.", {
 			recipient,
 			activity: json
@@ -5887,14 +6633,28 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await _fedify_vocab.Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader)
+				contextLoader: standardLoader
 			});
 		} catch (error) {
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
+		viewSource = rawViewSource;
 	}
 	observation.activity = activity;
+	let view;
+	try {
+		view = await buildVerifiedActivityView(snapshot, viewSource ?? rawViewSource);
+	} catch (error) {
+		if (!isPermanentActivityParseError(error)) throw error;
+		return await respondInvalidActivity(error);
+	}
+	const actorless = !skipSignatureVerification && getActorPresence(view.expanded) === "absent" && inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true;
+	span.setAttribute("activitypub.activity.actorless", actorless);
+	if (actorless && httpSigKey != null) {
+		const principal = getHttpKeyPrincipal(httpSigKey);
+		if (principal != null) requestSigners = [principal];
+	}
 	observation.stage = "policy";
 	observation.result = {
 		disposition: "rejected",
@@ -5938,7 +6698,7 @@ async function handleInboxInternal(request, parameters, span) {
 		const rejection = await require_http.observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
 			const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
 				[require_http.verificationObservation]: verification,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -5976,7 +6736,7 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 	}
-	if (httpSigKey != null && !await require_portable_collection.doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !actorless && !await require_portable_collection.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		observation.authentication = {
 			status: "rejected",
@@ -6002,6 +6762,66 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (httpSigKey != null && !actorless && activity.actorId != null) requestSigners = [{
+		kind: "actor",
+		id: activity.actorId,
+		mechanism: "httpSignatures",
+		keyId: httpSigKey.id
+	}];
+	if (actorless) {
+		const check = checkActorlessActivity(activity, {
+			verified: true,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: [],
+			baseUrl: null
+		});
+		if (check.status === "noAuthenticatedPrincipal") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: { type: "noAuthenticatedPrincipal" }
+			};
+			logger.error("The activity {activityId} declares no actor, and no principal is authenticated for it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href
+			});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: "No principal is authenticated for the activity."
+			});
+			return new Response("No principal is authenticated for the activity.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		} else if (check.status === "activityOriginMismatch") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: {
+					type: "activityOriginMismatch",
+					activityId: new URL(activity.id.href),
+					actorIds: check.principals.map((principal) => principal.id)
+				}
+			};
+			logger.error("The activity ({activityId}) does not have the same origin as the principals that authenticated it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href,
+				principals: check.principals.map((principal) => principal.id.href)
+			});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: `The activity (${activity.id?.href}) does not have the same origin as the principals that authenticated it.`
+			});
+			return new Response("The activity and its signers do not have the same origin.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (!skipSignatureVerification) {
 		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
 		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
@@ -6061,7 +6881,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
-	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+	if (!skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 		observation.authentication = {
 			status: "rejected",
 			reason: {
@@ -6090,7 +6910,7 @@ async function handleInboxInternal(request, parameters, span) {
 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
 	};
 	observation.stage = "dispatch";
-	if (activity.actorId == null) {
+	if (!actorless && activity.actorId == null) {
 		observation.result = {
 			disposition: "rejected",
 			reason: "missingActor"
@@ -6114,6 +6934,17 @@ async function handleInboxInternal(request, parameters, span) {
 		originalJson: json,
 		normalizedActivity: hasLdSignature && compactedJson !== json ? compactedJson : void 0,
 		ldSignatureVerified: hasLdSignature ? ldSigVerified : void 0,
+		authentication: createAuthenticationEvidence({
+			verified: !skipSignatureVerification,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: deepFreeze(view.expanded),
+			baseUrl: null
+		}),
+		verifiedView: view.view,
+		replayable: view.replayable,
+		actorless,
 		activity,
 		recipient,
 		inboxListeners,
@@ -6838,6 +7669,42 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
+* Turns the signers of verified Object Integrity Proofs into principals.
+*/
+function toProofPrincipals(signers) {
+	return signers.map((signer) => ({
+		kind: signer.kind,
+		id: signer.id,
+		mechanism: "objectIntegrityProofs",
+		keyId: signer.keyId
+	}));
+}
+/**
+* Gets the principal of an HTTP Signature key, whose owner was confirmed by
+* the owner's own document, or by the signed document of a portable actor,
+* when the key was fetched.
+*/
+function getHttpKeyPrincipal(key) {
+	const evidence = require_http.getVerifiedKeyOwnerEvidence(key);
+	if (evidence != null) try {
+		return {
+			kind: "actor",
+			id: (0, _fedify_vocab_runtime.parseIri)(evidence.ownerId),
+			mechanism: "httpSignatures",
+			keyId: key.id
+		};
+	} catch {
+		return null;
+	}
+	if (key.ownerId == null || require_http.isPortableId(key.ownerId)) return null;
+	return {
+		kind: "actor",
+		id: key.ownerId,
+		mechanism: "httpSignatures",
+		keyId: key.id
+	};
+}
+/**
 * Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
 * actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
 * URI, and it is owned by a portable actor, which only the portable actor's
@@ -9429,24 +10296,102 @@ var FederationImpl = class extends FederationBuilderImpl {
 			let dispatched;
 			let parseInput = void 0;
 			let parseContextLoader = context.contextLoader;
+			let authentication = getEmptyAuthenticationEvidence();
+			let actorPresence = "present";
+			if (message.verifiedView !== void 0) {
+				const view = parseSerializedVerifiedActivityView(message.verifiedView);
+				let restored;
+				let restoredAuthentication = null;
+				let failure;
+				if (view == null) failure = /* @__PURE__ */ new TypeError("The queued activity has a malformed verified view.");
+				else try {
+					if (view.source === "normalizedActivity") require_http.assertSafeJsonLd(message.normalizedActivity);
+					restored = await restoreVerifiedActivityView(view, message);
+				} catch (error) {
+					if (!(error instanceof ContextSnapshotMissError) && !isPermanentInboxParseError(error)) {
+						await handleRetriableFailure(error);
+						return;
+					}
+					failure = error;
+				}
+				if (restored != null) {
+					const expandedActivity = deepFreeze(restored.expanded);
+					restoredAuthentication = message.authentication === void 0 ? createAuthenticationEvidence({
+						...getEmptyAuthenticationEvidence(),
+						expandedActivity,
+						baseUrl: restored.baseUrl
+					}) : deserializeAuthentication(message.authentication, expandedActivity, restored.baseUrl);
+					if (restoredAuthentication == null) failure = /* @__PURE__ */ new TypeError("The queued activity has malformed authentication evidence.");
+				}
+				if (failure != null || restored == null || restoredAuthentication == null) {
+					await reportInboxError(failure);
+					logger.error("Failed to replay the queued incoming activity:\n{error}", {
+						error: failure,
+						trial: message.attempt,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: String(failure)
+					});
+					listenerSpan.end();
+					return;
+				}
+				authentication = restoredAuthentication;
+				actorPresence = getActorPresence(restored.expanded);
+				const policy = view.policy;
+				const replayLoader = createReleasableLoader(restored.loader, policy === "normalization" ? require_http.getNormalizationContextLoader(context.contextLoader) : require_http.wrapContextLoaderForJsonLd(context.contextLoader), policy);
+				parseInput = restored.document;
+				parseContextLoader = restored.loader;
+				try {
+					activity = await _fedify_vocab.Activity.fromJsonLd(restored.document, {
+						...context,
+						contextLoader: replayLoader.loader,
+						...restored.baseUrl == null ? {} : { baseUrl: restored.baseUrl }
+					});
+				} catch (error) {
+					if (isPermanentInboxParseError(error)) {
+						await reportInboxError(error);
+						logger.error("Failed to parse the queued incoming activity:\n{error}", {
+							error,
+							trial: message.attempt,
+							activity: message.activity,
+							recipient: message.identifier
+						});
+						listenerSpan.setStatus({
+							code: _opentelemetry_api.SpanStatusCode.ERROR,
+							message: String(error)
+						});
+						listenerSpan.end();
+						return;
+					}
+					await handleRetriableFailure(error);
+					return;
+				} finally {
+					replayLoader.release();
+				}
+			}
 			try {
-				const hasSignatureField = require_http.hasSignature(message.activity);
-				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
-				const parseContext = hasSignatureField ? {
-					...context,
-					contextLoader: require_http.getNormalizationContextLoader(context.contextLoader)
-				} : {
-					...context,
-					contextLoader: require_http.wrapContextLoaderForJsonLd(context.contextLoader)
-				};
-				parseContextLoader = parseContext.contextLoader;
-				let normalizedActivity;
-				if (shouldParseFromNormalizedSignedPayload) {
-					normalizedActivity = message.normalizedActivity ?? await require_http.compactJsonLd(message.activity, context.contextLoader);
-					require_http.assertSafeJsonLd(normalizedActivity);
+				if (activity == null) {
+					const hasSignatureField = require_http.hasSignature(message.activity);
+					const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
+					const parseContext = hasSignatureField ? {
+						...context,
+						contextLoader: require_http.getNormalizationContextLoader(context.contextLoader)
+					} : {
+						...context,
+						contextLoader: require_http.wrapContextLoaderForJsonLd(context.contextLoader)
+					};
+					parseContextLoader = parseContext.contextLoader;
+					let normalizedActivity;
+					if (shouldParseFromNormalizedSignedPayload) {
+						normalizedActivity = message.normalizedActivity ?? await require_http.compactJsonLd(message.activity, context.contextLoader);
+						require_http.assertSafeJsonLd(normalizedActivity);
+					}
+					parseInput = shouldParseFromNormalizedSignedPayload ? require_http.detachSignature(normalizedActivity) : hasSignatureField ? require_http.detachSignature(message.activity) : message.activity;
+					activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				}
-				parseInput = shouldParseFromNormalizedSignedPayload ? require_http.detachSignature(normalizedActivity) : hasSignatureField ? require_http.detachSignature(message.activity) : message.activity;
-				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				activityType = (0, _fedify_vocab.getTypeId)(activity).href;
 				span.setAttribute("activitypub.activity.type", activityType);
 				listenerSpan.setAttribute("activitypub.activity.type", activityType);
@@ -9455,7 +10400,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 					span.setAttribute("activitypub.activity.id", activity.id.href);
 					listenerSpan.setAttribute("activitypub.activity.id", activity.id.href);
 				}
-				if (activity.actorId == null) {
+				const actorless = actorPresence === "absent" && !this.skipSignatureVerification && authentication.verified && this.inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true && isActorlessActivityAuthenticated(activity, authentication);
+				if (activity.actorId == null && !actorless) {
 					logger.error("Missing actor in queued incoming activity.", {
 						activityId: activity.id?.href,
 						activity: message.activity,
@@ -9469,7 +10415,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+				if (!this.skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
 						activityId: activity.id.href,
 						actorIds: activity.actorIds.map((actor) => actor.href),
@@ -9484,22 +10430,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				cacheKey = activity.id == null ? null : [
-					...this.kvPrefixes.activityIdempotence,
-					context.origin,
-					activity.id.href
-				];
-				if (cacheKey != null) {
-					if (await this.kv.get(cacheKey) === true) {
-						logger.debug("Activity {activityId} has already been processed.", {
-							activityId: activity.id?.href,
-							activity: message.activity,
-							recipient: message.identifier
-						});
-						require_http.recordInboxActivity(this.meterProvider, "rejected", activityType);
-						listenerSpan.end();
-						return;
-					}
+				const parsedActivity = activity;
+				const parsedActivityType = activityType;
+				cacheKey = await getInboxIdempotencyKey(this.idempotencyStrategy, () => context.toInboxContext(message.identifier, message.activity, parsedActivity.id?.href, parsedActivityType, { authentication }), activity, context.origin, message.identifier, this.kvPrefixes.activityIdempotence);
+				if (await isInboxActivityProcessed(this.kv, cacheKey, activity, context.origin, this.kvPrefixes.activityIdempotence)) {
+					logger.debug("Activity {activityId} has already been processed.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					require_http.recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
 				}
 				dispatched = this.inboxListeners?.dispatchWithClass(activity);
 			} catch (error) {
@@ -9558,7 +10500,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			try {
 				const started = performance.now();
 				try {
-					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType, { authentication }), activity);
 				} finally {
 					this.metrics.recordInboxProcessingDuration(activityType, require_http.getDurationMs(started));
 				}
@@ -10865,7 +11807,7 @@ var ContextImpl = class ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
 		});
 	}
-	toInboxContext(recipient, activity, activityId, activityType) {
+	toInboxContext(recipient, activity, activityId, activityType, metadata) {
 		return new InboxContextImpl(recipient, activity, activityId, activityType, {
 			url: this.url,
 			federation: this.federation,
@@ -10873,7 +11815,7 @@ var ContextImpl = class ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, metadata?.authentication);
 	}
 	toOutboxContext(identifier, activity, activityId, activityType) {
 		return new OutboxContextImpl(identifier, activity, activityId, activityType, {
@@ -11488,12 +12430,20 @@ var ContextImpl = class ContextImpl {
 		});
 	}
 	async routeActivityInternal(recipient, activity, options = {}, span) {
+		const snapshot = createContextSnapshot(options.contextLoader ?? this.contextLoader);
+		try {
+			return await this.#routeActivityWithSnapshot(recipient, activity, options, span, snapshot);
+		} finally {
+			snapshot.release();
+		}
+	}
+	async #routeActivityWithSnapshot(recipient, activity, options, span, snapshot) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
 			"inbox"
 		]);
-		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const contextLoader = snapshot.loader("standard");
 		let json = await activity.toJsonLd({ contextLoader });
 		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
 			documentLoader: this.documentLoader,
@@ -11501,13 +12451,19 @@ var ContextImpl = class ContextImpl {
 			tracerProvider: this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
 		});
-		if (await require_http.verifyObject(_fedify_vocab.Activity, json, {
+		let documentSigners = [];
+		let originAuthenticated = [];
+		let viewSource;
+		let fetchedView;
+		const document = require_http.detachSignature(json);
+		const verified = await require_http.verifyObjectDetailed(_fedify_vocab.Activity, document, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			meterProvider: this.meterProvider,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyCache
-		}) == null) {
+		});
+		if (verified.status !== "verified") {
 			logger.debug("Object Integrity Proofs are not verified.", {
 				recipient,
 				activity: json
@@ -11519,8 +12475,29 @@ var ContextImpl = class ContextImpl {
 				});
 				return false;
 			}
-			const fetched = await this.lookupObject(activity.id, options);
-			if (fetched == null) {
+			let candidate;
+			let candidateView;
+			const verifications = /* @__PURE__ */ new WeakMap();
+			const fetched = await this.lookupObject(activity.id, {
+				...options,
+				contextLoader,
+				verifyPortableObject: async (document, verifierOptions) => {
+					const result = await this.verifyPortableObject(document, verifierOptions);
+					if (document != null && typeof document === "object") verifications.set(document, result);
+					return result;
+				},
+				[_fedify_vocab.lookupObserver]: { accept: async (accepted) => {
+					candidate = accepted;
+					candidateView = await buildVerifiedActivityView(createContextSnapshot(accepted.contextLoader), {
+						policy: "standard",
+						source: "activity",
+						document: require_http.detachSignature(accepted.document),
+						baseUrl: accepted.baseUrl
+					});
+					return true;
+				} }
+			});
+			if (fetched == null || candidate == null || candidateView == null) {
 				logger.debug("Failed to fetch the remote activity object {activityId}.", {
 					recipient,
 					activity: json,
@@ -11556,11 +12533,50 @@ var ContextImpl = class ContextImpl {
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
-			json = await fetched.toJsonLd({ contextLoader });
-		} else logger.debug("Object Integrity Proofs are verified.", {
-			recipient,
-			activity: json
-		});
+			json = candidate.document;
+			fetchedView = candidateView;
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document: require_http.detachSignature(candidate.document),
+				baseUrl: candidate.baseUrl
+			};
+			if (require_http.isPortableId(fetched.id)) {
+				const result = verifications.get(candidate.document);
+				if (result?.verified === true && result.method === "proof") documentSigners = result.keys.flatMap((key) => {
+					const signer = require_http.getProofSigner(key);
+					return signer == null ? [] : [{
+						kind: signer.kind,
+						id: signer.id,
+						mechanism: "objectIntegrityProofs",
+						keyId: signer.keyId
+					}];
+				});
+			} else originAuthenticated = fetched.actorIds.map((actorId) => ({
+				kind: "actor",
+				id: actorId,
+				mechanism: "origin",
+				keyId: null
+			}));
+		} else {
+			logger.debug("Object Integrity Proofs are verified.", {
+				recipient,
+				activity: json
+			});
+			activity = verified.object;
+			documentSigners = verified.signers.map((signer) => ({
+				kind: signer.kind,
+				id: signer.id,
+				mechanism: "objectIntegrityProofs",
+				keyId: signer.keyId
+			}));
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document,
+				baseUrl: null
+			};
+		}
 		if (activity.actorId == null) {
 			logger.debug("Activity is missing an actor; unable to verify.", {
 				recipient,
@@ -11575,10 +12591,21 @@ var ContextImpl = class ContextImpl {
 			});
 			return false;
 		}
+		const view = fetchedView ?? await buildVerifiedActivityView(snapshot, viewSource);
 		const routeResult = await routeActivity({
 			context: this,
 			json,
 			ldSignatureVerified: false,
+			authentication: createAuthenticationEvidence({
+				verified: true,
+				requestSigners: [],
+				documentSigners,
+				originAuthenticated,
+				expandedActivity: deepFreeze(view.expanded),
+				baseUrl: viewSource.baseUrl
+			}),
+			verifiedView: view.view,
+			replayable: view.replayable,
 			activity,
 			recipient,
 			inboxListeners: this.federation.inboxListeners,
@@ -11929,12 +12956,14 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 	activity;
 	activityId;
 	activityType;
-	constructor(recipient, activity, activityId, activityType, options) {
+	authentication;
+	constructor(recipient, activity, activityId, activityType, options, authentication) {
 		super(options);
 		this.recipient = recipient;
 		this.activity = activity;
 		this.activityId = activityId;
 		this.activityType = activityType;
+		this.authentication = authentication ?? getEmptyAuthenticationEvidence();
 	}
 	clone(data) {
 		return new InboxContextImpl(this.recipient, this.activity, this.activityId, this.activityType, {
@@ -11944,7 +12973,7 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, this.authentication);
 	}
 	forwardActivity(forwarder, recipients, options) {
 		return forwardActivity(this, "inbox", forwarder, recipients, options).then(() => void 0);
@@ -12237,6 +13266,11 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 	* @since 2.4.0
 	*/
 	atomicEnqueueMany;
+	/**
+	* Inherits the message size limit from the wrapped queue.
+	* @since 2.5.0
+	*/
+	maxMessageSize;
 	getDepth;
 	/**
 	* Tracks which ordering keys are currently being processed to ensure
@@ -12262,6 +13296,7 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 		this.workers = workers;
 		this.nativeRetrial = queue.nativeRetrial;
 		this.nativeDeduplication = queue.nativeDeduplication;
+		this.maxMessageSize = queue.maxMessageSize;
 		this.atomicEnqueueMany = queue.enqueueMany == null ? false : queue.atomicEnqueueMany;
 		if (queue.getDepth != null) this.getDepth = () => queue.getDepth();
 	}
@@ -12567,6 +13602,12 @@ Object.defineProperty(exports, "handleWebFinger", {
 		return handleWebFinger;
 	}
 });
+Object.defineProperty(exports, "isActorAuthenticated", {
+	enumerable: true,
+	get: function() {
+		return isActorAuthenticated;
+	}
+});
 Object.defineProperty(exports, "normalizeCircuitBreakerOptions", {
 	enumerable: true,
 	get: function() {