@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/{federation-BVH7drJA.cjs → federation-D0AZw_aw.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-BfW3wyQ4.cjs");
-const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-C-Z1SKDy.cjs");
-const require_kv_cache = require("./kv-cache-kkBB0vbI.cjs");
+const require_http = require("./http-kv1LZw-r.cjs");
+const require_types = require("./types-hKCCjii0.cjs");
+const require_portable_collection = require("./portable-collection-DciwBIia.cjs");
+const require_kv_cache = require("./kv-cache-Ddh5sMxH.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -15,7 +15,10 @@ let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
 let es_toolkit = require("es-toolkit");
+let json_canon = require("json-canon");
+json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
+let _fedify_vocab_runtime_internal = require("@fedify/vocab-runtime/internal");
 let _fedify_webfinger = require("@fedify/webfinger");
 let _opentelemetry_sdk_metrics = require("@opentelemetry/sdk-metrics");
 let devalue = require("devalue");
@@ -32,9 +35,12 @@ var ActivityListenerSet = class {
 		clone.#listeners = new Map(this.#listeners);
 		return clone;
 	}
-	add(type, listener) {
+	add(type, listener, options = {}) {
 		if (this.#listeners.has(type)) throw new TypeError("Listener already set for this type.");
-		this.#listeners.set(type, listener);
+		this.#listeners.set(type, {
+			listener,
+			options: { ...options }
+		});
 	}
 	dispatchWithClass(activity) {
 		let cls = activity.constructor;
@@ -44,10 +50,11 @@ var ActivityListenerSet = class {
 			cls = globalThis.Object.getPrototypeOf(cls);
 		}
 		if (cls == null) return null;
-		const listener = this.#listeners.get(cls);
+		const { listener, options } = this.#listeners.get(cls);
 		return {
 			class: cls,
-			listener
+			listener,
+			options
 		};
 	}
 	dispatch(activity) {
@@ -635,8 +642,8 @@ var FederationBuilderImpl = class {
 		}
 		const listeners = this.inboxListeners = new ActivityListenerSet();
 		const setters = {
-			on(type, listener) {
-				listeners.add(type, listener);
+			on(type, listener, options) {
+				listeners.add(type, listener, options);
 				return setters;
 			},
 			onError: (handler) => {
@@ -2805,6 +2812,172 @@ async function isInAudience(object, actor, options = {}) {
 	return false;
 }
 //#endregion
+//#region src/federation/inbox-authentication.ts
+/**
+* The evidence of an activity that has not been authenticated by Fedify.
+*/
+const EMPTY_EVIDENCE = Object.freeze({
+	verified: false,
+	requestSigners: Object.freeze([]),
+	documentSigners: Object.freeze([]),
+	originAuthenticated: Object.freeze([]),
+	expandedActivity: Object.freeze([]),
+	baseUrl: null
+});
+/**
+* Gets the evidence of an activity that has not been authenticated.
+* @internal
+*/
+function getEmptyAuthenticationEvidence() {
+	return EMPTY_EVIDENCE;
+}
+/**
+* Gets the principals that an authorization decision should rely on.
+* @param evidence The evidence.
+* @param scope See {@link IsActorAuthenticatedOptions.scope}.
+* @returns The principals.
+* @internal
+*/
+function getEffectivePrincipals(evidence, scope = "effective") {
+	if (scope === "document" || evidence.documentSigners.length > 0) return evidence.documentSigners;
+	if (evidence.requestSigners.length > 0) return evidence.requestSigners;
+	return evidence.originAuthenticated;
+}
+/**
+* Normalizes an actor ID for comparison: portable IDs and compatible
+* identifiers to their canonical portable ID, other IDs to their `href`.
+* @returns The normalized ID, or `null` for a malformed portable ID.
+*/
+function normalizeActorId(id) {
+	return require_http.isPortableId(id) ? require_http.getCanonicalPortableId(id) : id.href;
+}
+/**
+* Checks whether the given principal authenticates the given actor.
+* @param principal The principal.
+* @param actorId The actor ID.
+* @returns `true` if the principal authenticates the actor.
+* @internal
+*/
+function principalAuthenticates(principal, actorId) {
+	if (principal.kind === "portableAuthority") {
+		if (!require_http.isPortableId(actorId)) return false;
+		const did = require_http.getPortableDid(actorId);
+		return did != null && did === require_http.getPortableDid(principal.id);
+	}
+	const expected = normalizeActorId(actorId);
+	return expected != null && normalizeActorId(principal.id) === expected;
+}
+/**
+* Checks whether the given evidence authenticates the given actor.
+*
+* Actor IDs are compared exactly, except that [FEP-ef61] portable IDs and
+* compatible identifiers are compared by their canonical portable IDs, and
+* a portable authority (a DID) authenticates the portable actors of that DID.
+*
+* @example
+* ``` typescript
+* federation
+*   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+*   .on(Follow, async (ctx, follow) => {
+*     if (follow.actorId == null) return;
+*     // The actor is always authenticated for activities that declare one,
+*     // but the same check works for any actor an activity names:
+*     isActorAuthenticated(ctx.authentication, follow.actorId);
+*   });
+* ```
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param evidence The authentication evidence, usually
+*                 {@link InboxContext.authentication}.
+* @param actorId The actor ID to check.
+* @param options Options.
+* @returns `true` if the actor is authenticated.
+* @since 2.5.0
+*/
+function isActorAuthenticated(evidence, actorId, options = {}) {
+	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
+}
+function serializePrincipal(principal) {
+	return {
+		kind: principal.kind,
+		id: principal.id.href,
+		mechanism: principal.mechanism,
+		keyId: principal.keyId?.href ?? null
+	};
+}
+/**
+* Serializes the principals of the given evidence for a queued message.
+* @internal
+*/
+function serializeAuthentication(evidence) {
+	return {
+		verified: evidence.verified,
+		requestSigners: evidence.requestSigners.map(serializePrincipal),
+		documentSigners: evidence.documentSigners.map(serializePrincipal),
+		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
+	};
+}
+const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
+const MECHANISMS = /* @__PURE__ */ new Set([
+	"httpSignatures",
+	"linkedDataSignatures",
+	"objectIntegrityProofs",
+	"origin"
+]);
+function deserializePrincipals(value) {
+	if (!Array.isArray(value)) return null;
+	const principals = [];
+	for (const item of value) {
+		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		principals.push(Object.freeze({
+			kind: item.kind,
+			id: new URL(item.id),
+			mechanism: item.mechanism,
+			keyId: item.keyId == null ? null : new URL(item.keyId)
+		}));
+	}
+	return principals;
+}
+/**
+* Restores the evidence of a queued message.
+* @param value The serialized principals.
+* @param expandedActivity The expanded activity, restored from the queued
+*                         verified view.
+* @param baseUrl The base URL, restored from the queued verified view.
+* @returns The evidence, or `null` if the serialized value is malformed.
+* @internal
+*/
+function deserializeAuthentication(value, expandedActivity, baseUrl) {
+	if (value == null || typeof value !== "object" || typeof value.verified !== "boolean") return null;
+	const record = value;
+	const requestSigners = deserializePrincipals(record.requestSigners);
+	const documentSigners = deserializePrincipals(record.documentSigners);
+	const originAuthenticated = deserializePrincipals(record.originAuthenticated);
+	if (requestSigners == null || documentSigners == null || originAuthenticated == null) return null;
+	return createAuthenticationEvidence({
+		verified: record.verified,
+		requestSigners,
+		documentSigners,
+		originAuthenticated,
+		expandedActivity,
+		baseUrl
+	});
+}
+/**
+* Creates frozen evidence.
+* @internal
+*/
+function createAuthenticationEvidence(evidence) {
+	return Object.freeze({
+		verified: evidence.verified,
+		requestSigners: Object.freeze([...evidence.requestSigners]),
+		documentSigners: Object.freeze([...evidence.documentSigners]),
+		originAuthenticated: Object.freeze([...evidence.originAuthenticated]),
+		expandedActivity: evidence.expandedActivity,
+		baseUrl: evidence.baseUrl
+	});
+}
+//#endregion
 //#region src/federation/inbox.ts
 const Temporal$10 = require_http.Temporal;
 /**
@@ -2827,13 +3000,135 @@ function actorsHaveSameOrigin(activity) {
 	const origin = require_http.getAuthenticationOrigin(activity.id);
 	return origin != null && activity.actorIds.every((actor) => require_http.getAuthenticationOrigin(actor) === origin);
 }
-async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
+/**
+* The headroom that the size check of a queued inbox message leaves for the
+* fields that grow when Fedify retries the message, e.g., its attempt count.
+*/
+const QUEUED_MESSAGE_HEADROOM = 64;
+/**
+* Computes the idempotency key of an incoming activity.
+* @returns The key, or `null` if the activity is not deduplicated.
+* @internal
+*/
+async function getInboxIdempotencyKey(strategy, inboxContext, activity, origin, recipient, prefix) {
+	if (activity.id == null) return null;
+	strategy ??= "per-inbox";
+	let keyString;
+	if (typeof strategy === "function") keyString = await strategy(inboxContext(), activity);
+	else switch (strategy) {
+		case "global":
+			keyString = activity.id.href;
+			break;
+		case "per-origin":
+			keyString = `${origin}\n${activity.id.href}`;
+			break;
+		case "per-inbox":
+			keyString = `${origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
+			break;
+		default: keyString = `${origin}\n${activity.id.href}`;
+	}
+	return keyString == null ? null : [...prefix, keyString];
+}
+/**
+* Checks whether an incoming activity has already been processed, by its
+* idempotency key, or by the key that queue workers of older versions of
+* Fedify recorded.
+* @internal
+*/
+async function isInboxActivityProcessed(kv, cacheKey, activity, origin, prefix) {
+	if (cacheKey == null) return false;
+	if (await kv.get(cacheKey) === true) return true;
+	if (activity.id == null) return false;
+	return await kv.get([
+		...prefix,
+		origin,
+		activity.id.href
+	]) === true;
+}
+/**
+* The bytes added to the UTF-8 JSON length of a message for each of its JSON
+* values, to bound the size of serialization formats other than JSON, such
+* as the structured serialization of Deno KV, which spends more bytes than
+* JSON on type tags and lengths of small values, e.g., empty arrays, and up
+* to nine bytes on a fractional number that JSON writes in three.
+*/
+const PER_VALUE_SERIALIZATION_OVERHEAD = 8;
+/**
+* Estimates, conservatively, how large a queued message is once a queue
+* backend serializes it: the UTF-8 length of its JSON serialization, plus
+* a fixed overhead for each JSON value in it, plus the bytes that encoding
+* strings beyond Latin-1 as UTF-16 adds.
+* @internal
+*/
+function estimateQueuedMessageSize(message) {
+	const encoder = new TextEncoder();
+	let values = 0;
+	let stringExpansion = 0;
+	const countString = (value) => {
+		values++;
+		if (!/[\u0100-\uffff]/.test(value)) return;
+		const expansion = value.length * 2 - encoder.encode(value).byteLength;
+		if (expansion > 0) stringExpansion += expansion;
+	};
+	const count = (value) => {
+		if (typeof value === "string") {
+			countString(value);
+			return;
+		}
+		values++;
+		if (Array.isArray(value)) for (const item of value) count(item);
+		else if (value != null && typeof value === "object") for (const [key, item] of Object.entries(value)) {
+			if (item === void 0) continue;
+			countString(key);
+			count(item);
+		}
+	};
+	count(message);
+	return encoder.encode(JSON.stringify(message)).byteLength + stringExpansion + values * PER_VALUE_SERIALIZATION_OVERHEAD;
+}
+/**
+* Checks whether an activity that declares no actor is authenticated: at
+* least one principal must be authenticated for it, and its ID, if any, must
+* have the same [FEP-fe34] origin as one of those principals.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @returns `"ok"` if it is authenticated, or why it is not.
+* @internal
+*/
+function checkActorlessActivity(activity, authentication) {
+	const principals = getEffectivePrincipals(authentication);
+	if (principals.length < 1) return {
+		status: "noAuthenticatedPrincipal",
+		principals
+	};
+	if (activity.id == null) return {
+		status: "ok",
+		principals
+	};
+	const origin = require_http.getAuthenticationOrigin(activity.id);
+	if (origin == null || !principals.some((principal) => require_http.getAuthenticationOrigin(principal.id) === origin)) return {
+		status: "activityOriginMismatch",
+		principals
+	};
+	return {
+		status: "ok",
+		principals
+	};
+}
+/**
+* Same as {@link checkActorlessActivity}, but returns a boolean.
+* @internal
+*/
+function isActorlessActivityAuthenticated(activity, authentication) {
+	return checkActorlessActivity(activity, authentication).status === "ok";
+}
+async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, authentication, verifiedView, replayable, actorless, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
-	if (activity.actorId == null) {
+	if (activity.actorId == null && !actorless) {
 		logger.error("Missing actor.", { activity: json });
 		span.setStatus({
 			code: _opentelemetry_api.SpanStatusCode.ERROR,
@@ -2842,58 +3137,59 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 		require_http.recordInboxActivity(meterProvider, "rejected", (0, _fedify_vocab.getTypeId)(activity).href);
 		return "missingActor";
 	}
-	let cacheKey = null;
-	if (activity.id != null) {
-		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href);
-		const strategy = idempotencyStrategy ?? "per-inbox";
-		let keyString;
-		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
-		else switch (strategy) {
-			case "global":
-				keyString = activity.id.href;
-				break;
-			case "per-origin":
-				keyString = `${ctx.origin}\n${activity.id.href}`;
-				break;
-			case "per-inbox":
-				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
-				break;
-			default: keyString = `${ctx.origin}\n${activity.id.href}`;
-		}
-		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
+	const contextMetadata = { authentication };
+	const cacheKey = await getInboxIdempotencyKey(idempotencyStrategy, () => inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href, contextMetadata), activity, ctx.origin, recipient, kvPrefixes.activityIdempotence);
+	if (await isInboxActivityProcessed(kv, cacheKey, activity, ctx.origin, kvPrefixes.activityIdempotence)) {
+		logger.debug("Activity {activityId} has already been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.UNSET,
+			message: `Activity ${activity.id?.href} has already been processed.`
+		});
+		require_http.recordInboxActivity(meterProvider, "rejected", (0, _fedify_vocab.getTypeId)(activity).href);
+		return "alreadyProcessed";
 	}
-	if (cacheKey != null) {
-		if (await kv.get(cacheKey) === true) {
-			logger.debug("Activity {activityId} has already been processed.", {
+	if (activity.actorId != null) span.setAttribute("activitypub.actor.id", activity.actorId.href);
+	let message;
+	if (queue != null) {
+		const carrier = {};
+		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+		message = {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: ctx.origin,
+			activity: originalJson ?? json,
+			...normalizedActivity == null ? {} : { normalizedActivity },
+			...ldSignatureVerified == null ? {} : { ldSignatureVerified },
+			...verifiedView == null ? {} : { verifiedView },
+			...authentication == null ? {} : { authentication: serializeAuthentication(authentication) },
+			identifier: recipient,
+			attempt: 0,
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			traceContext: carrier
+		};
+		const maxMessageSize = queue.maxMessageSize;
+		if (replayable === false) {
+			logger.warn("The incoming activity {activityId} uses a JSON-LD context that cannot be kept for the queue; processing it immediately instead.", {
 				activityId: activity.id?.href,
-				activity: json,
 				recipient
 			});
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.UNSET,
-				message: `Activity ${activity.id?.href} has already been processed.`
+			message = void 0;
+		} else if (maxMessageSize != null && estimateQueuedMessageSize(message) > maxMessageSize - QUEUED_MESSAGE_HEADROOM) {
+			logger.warn("The incoming activity {activityId} is too large to enqueue; processing it immediately instead.", {
+				activityId: activity.id?.href,
+				recipient,
+				maxMessageSize
 			});
-			require_http.recordInboxActivity(meterProvider, "rejected", (0, _fedify_vocab.getTypeId)(activity).href);
-			return "alreadyProcessed";
+			message = void 0;
 		}
 	}
-	span.setAttribute("activitypub.actor.id", activity.actorId.href);
-	if (queue != null) {
-		const carrier = {};
-		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
+	if (queue != null && message != null) {
 		try {
-			await queue.enqueue({
-				type: "inbox",
-				id: crypto.randomUUID(),
-				baseUrl: ctx.origin,
-				activity: originalJson ?? json,
-				...normalizedActivity == null ? {} : { normalizedActivity },
-				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
-				identifier: recipient,
-				attempt: 0,
-				started: (/* @__PURE__ */ new Date()).toISOString(),
-				traceContext: carrier
-			});
+			await queue.enqueue(message);
 		} catch (error) {
 			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
 				error,
@@ -2943,7 +3239,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			const started = performance.now();
 			try {
 				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
-				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType), activity);
+				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType, contextMetadata), activity);
 			} finally {
 				require_http.getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, require_http.getDurationMs(started));
 			}
@@ -2984,6 +3280,382 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
+//#region src/federation/inbox-view.ts
+/**
+* The interpretation of an incoming activity that Fedify authenticated, kept
+* so that listeners, authorization helpers, and queue workers observe the
+* same JSON-LD meaning that signature verification observed.
+*
+* Every JSON-LD processing step of one delivery goes through a request-scoped
+* *context snapshot*, which memoizes the remote context responses so that
+* a nondeterministic or mutable remote context cannot give verification and
+* dispatch different meanings.  The snapshot is serialized into queued
+* messages, so that workers and retries replay the very same responses
+* without loading contexts again.
+* @module
+*/
+/**
+* Thrown when replaying an interpretation needs a context response that its
+* snapshot does not have, or has with a different content.
+* @internal
+*/
+var ContextSnapshotMissError = class extends Error {
+	url;
+	constructor(url, reason) {
+		super(`Context ${url} cannot be replayed: ${reason}.`);
+		this.name = "ContextSnapshotMissError";
+		this.url = url;
+	}
+};
+function normalizeUrl(url) {
+	return URL.canParse(url) ? new URL(url).href : url;
+}
+/**
+* Creates the context snapshot of a delivery.
+* @param base The caller's context loader.
+* @returns The snapshot.
+* @internal
+*/
+function createContextSnapshot(base) {
+	const underlying = {
+		standard: require_http.wrapContextLoaderForJsonLd(base),
+		normalization: require_http.getNormalizationContextLoader(base)
+	};
+	const cache = /* @__PURE__ */ new Map();
+	const recorded = /* @__PURE__ */ new Map();
+	const loaders = /* @__PURE__ */ new Map();
+	let released = false;
+	return {
+		loader(policy) {
+			let loader = loaders.get(policy);
+			if (loader != null) return loader;
+			const effective = underlying[policy];
+			loader = require_http.markEffectiveContextLoader(async (url, options) => {
+				if (released) return await effective(url, options);
+				const normalizedUrl = normalizeUrl(url);
+				const key = `${policy}\n${normalizedUrl}`;
+				let promise = cache.get(key);
+				if (promise == null) {
+					promise = Promise.resolve(effective(url, options)).then((response) => {
+						const cloned = normalizeResponse(structuredClone(response));
+						recorded.set(key, {
+							policy,
+							url: normalizedUrl,
+							response: structuredClone(cloned)
+						});
+						return cloned;
+					});
+					promise.catch(() => {});
+					cache.set(key, promise);
+				}
+				return structuredClone(await promise);
+			}, policy);
+			loaders.set(policy, loader);
+			return loader;
+		},
+		entries() {
+			return [...recorded.values()];
+		},
+		release() {
+			released = true;
+		}
+	};
+}
+function getBundledResponse(url) {
+	if (!(url in _fedify_vocab_runtime.preloadedContexts)) return null;
+	return {
+		contextUrl: null,
+		document: _fedify_vocab_runtime.preloadedContexts[url],
+		documentUrl: url
+	};
+}
+async function sha256(value) {
+	return (0, byte_encodings_hex.encodeHex)(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, json_canon.default)(value))));
+}
+function normalizeResponse(response) {
+	return {
+		contextUrl: response.contextUrl ?? null,
+		document: response.document,
+		documentUrl: response.documentUrl
+	};
+}
+/**
+* Serializes the entries of a context snapshot for a queued message.
+* @param entries The entries.
+* @returns The serialized entries, which are plain JSON values.
+* @internal
+*/
+async function serializeContextSnapshot(entries) {
+	const result = [];
+	for (const entry of entries) {
+		const response = normalizeResponse(entry.response);
+		const hash = await sha256(response);
+		const bundled = getBundledResponse(entry.url);
+		if (bundled != null && await sha256(bundled) === hash) result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			bundled: true
+		});
+		else result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+function isRemoteDocument(value) {
+	if (value == null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.documentUrl === "string" && "document" in record && (record.contextUrl == null || typeof record.contextUrl === "string");
+}
+/**
+* Restores the entries of a serialized context snapshot, verifying the
+* hashes of stored responses.  Bundled entries are reconstructed from the
+* contexts this version of Fedify bundles.
+* @param entries The serialized entries.
+* @returns The entries.
+* @throws {ContextSnapshotMissError} If an entry is malformed, or its
+*                                    content does not match its hash.
+* @internal
+*/
+async function deserializeContextSnapshot(entries) {
+	if (!Array.isArray(entries)) throw new ContextSnapshotMissError("(snapshot)", "malformed snapshot");
+	const result = [];
+	for (const entry of entries) {
+		if (entry == null || typeof entry !== "object" || entry.policy !== "standard" && entry.policy !== "normalization" || typeof entry.url !== "string" || typeof entry.sha256 !== "string") throw new ContextSnapshotMissError("(snapshot)", "malformed entry");
+		let response;
+		if (entry.bundled === true) {
+			response = getBundledResponse(entry.url);
+			if (response == null) throw new ContextSnapshotMissError(entry.url, "not bundled");
+		} else if (isRemoteDocument(entry.response)) response = normalizeResponse(entry.response);
+		else throw new ContextSnapshotMissError(entry.url, "malformed entry");
+		if (entry.bundled !== true && await sha256(response) !== entry.sha256) throw new ContextSnapshotMissError(entry.url, "content mismatch");
+		result.push({
+			policy: entry.policy,
+			url: entry.url,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+/**
+* Creates a context loader of a policy that serves only the responses of
+* a snapshot.  It is marked as the effective loader of the policy.
+* @param entries The snapshot's entries.
+* @param policy The policy.
+* @returns The loader, which throws {@link ContextSnapshotMissError} for
+*          anything else.
+* @internal
+*/
+function createSnapshotOnlyLoader(entries, policy) {
+	const responses = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (entry.policy === policy) responses.set(entry.url, entry.response);
+	return require_http.markEffectiveContextLoader(async (url) => {
+		const response = responses.get(normalizeUrl(url));
+		if (response == null) throw new ContextSnapshotMissError(url, "not in the snapshot");
+		return structuredClone(response);
+	}, policy);
+}
+/**
+* Creates a {@link ReleasableLoader}.
+* @param strict The loader to use until release.
+* @param fallback The loader to use after release.
+* @param policy The policy both loaders apply.
+* @returns The releasable loader.
+* @internal
+*/
+function createReleasableLoader(strict, fallback, policy) {
+	let released = false;
+	return {
+		loader: require_http.markEffectiveContextLoader((url, options) => released ? fallback(url, options) : strict(url, options), policy),
+		release() {
+			released = true;
+		}
+	};
+}
+/**
+* Expands a JSON-LD document with the given context loader.
+* @param document The document.
+* @param contextLoader The context loader.
+* @returns The expanded document.
+* @internal
+*/
+async function expandDocument(document, contextLoader) {
+	return await _fedify_vocab_runtime_jsonld.default.expand(document, { documentLoader: contextLoader });
+}
+/**
+* Computes the digest of an expanded document.
+* @param expanded The expanded document.
+* @returns The hex-encoded SHA-256 of its canonical JSON.
+* @internal
+*/
+function digestExpandedDocument(expanded) {
+	return sha256(expanded);
+}
+/**
+* Deeply freezes a JSON value.
+* @param value The value.
+* @returns The same value, frozen.
+* @internal
+*/
+function deepFreeze(value) {
+	if (value != null && typeof value === "object" && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
+const ACTOR_IRI = "https://www.w3.org/ns/activitystreams#actor";
+/**
+* Gets the single root node of an expanded document.
+* @param expanded The expanded document.
+* @returns The root node, or `null` if there is not exactly one.
+* @internal
+*/
+function getRootNode(expanded) {
+	if (expanded.length !== 1) return null;
+	const node = expanded[0];
+	if (node == null || typeof node !== "object" || Array.isArray(node)) return null;
+	return node;
+}
+/**
+* Gets the values of a property of an expanded node, unwrapping a single
+* `@list` container the way generated vocabulary decoders do.
+* @param node The expanded node.
+* @param iri The property IRI.
+* @returns The values, or an empty array if the property is absent.
+* @internal
+*/
+function getPropertyValues(node, iri) {
+	const values = node[iri];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return [values];
+	if (values.length === 1 && values[0] != null && typeof values[0] === "object" && "@list" in values[0]) {
+		const list = values[0]["@list"];
+		return Array.isArray(list) ? list : [list];
+	}
+	return values;
+}
+/**
+* Tells whether the root node of an expanded activity declares any `actor`
+* value at all, including blank nodes, anonymous or untyped nodes, and
+* literals, which ID accessors and typed parsing may drop.
+* @param expanded The expanded activity.
+* @returns `"absent"` if the root node declares no actor; `"present"`
+*          otherwise, including when there is no single root node.
+* @internal
+*/
+function getActorPresence(expanded) {
+	const root = getRootNode(expanded);
+	if (root == null) return "present";
+	return getPropertyValues(root, ACTOR_IRI).length < 1 ? "absent" : "present";
+}
+/**
+* Builds the serialized view of an authenticated activity.  The document is
+* expanded through the snapshot, so that the snapshot holds every context
+* response the interpretation needs.
+* @param snapshot The delivery's context snapshot.
+* @param source Which document the activity was parsed from.
+* @returns The serialized view and the expanded activity.
+* @internal
+*/
+async function buildVerifiedActivityView(snapshot, source) {
+	const loader = snapshot.loader(source.policy);
+	const used = /* @__PURE__ */ new Set();
+	const expanded = await expandDocument(source.document, require_http.markEffectiveContextLoader((url, options) => {
+		used.add(normalizeUrl(url));
+		return loader(url, options);
+	}, source.policy));
+	const entries = snapshot.entries().filter((entry) => entry.policy === source.policy && used.has(entry.url));
+	const contexts = await serializeContextSnapshot(entries);
+	const references = /* @__PURE__ */ new Set();
+	collectContextReferences(source.document, source.baseUrl?.href, references);
+	for (const entry of entries) {
+		const { contextUrl, document } = entry.response;
+		collectContextReferences(document, entry.url, references);
+		if (contextUrl != null) collectContextReferences({ "@context": contextUrl }, entry.url, references);
+	}
+	return {
+		replayable: [...references].every((url) => used.has(url)),
+		view: {
+			version: 1,
+			policy: source.policy,
+			source: source.source,
+			baseUrl: source.baseUrl?.href ?? null,
+			contexts,
+			expandedDigest: await digestExpandedDocument(expanded)
+		},
+		expanded
+	};
+}
+/**
+* Collects the remote context references of a JSON-LD document or context
+* document: every IRI given as a value of `@context` at any depth, including
+* scoped contexts of term definitions, and of `@import`.
+* @param value The document.
+* @param base The URL to resolve relative references against.
+* @param references The set to add the normalized references to.
+*/
+function collectContextReferences(value, base, references) {
+	const add = (reference) => {
+		let url = reference;
+		if (base != null && URL.canParse(reference, base)) url = new URL(reference, base).href;
+		references.add(normalizeUrl(url));
+	};
+	const collectContext = (context) => {
+		if (typeof context === "string") add(context);
+		else if (Array.isArray(context)) for (const item of context) collectContext(item);
+		else if (context != null && typeof context === "object") {
+			const imported = context["@import"];
+			if (typeof imported === "string") add(imported);
+			walk(context);
+		}
+	};
+	const walk = (node) => {
+		if (Array.isArray(node)) for (const item of node) walk(item);
+		else if (node != null && typeof node === "object") for (const [key, item] of Object.entries(node)) if (key === "@context") collectContext(item);
+		else walk(item);
+	};
+	walk(value);
+}
+/**
+* Validates the shape of a serialized view taken from a queued message.
+* @param value The value of the message's `verifiedView` field.
+* @returns The view, or `null` if it is malformed or of an unsupported
+*          version.
+* @internal
+*/
+function parseSerializedVerifiedActivityView(value) {
+	if (value == null || typeof value !== "object") return null;
+	const view = value;
+	if (view.version !== 1 || view.policy !== "standard" && view.policy !== "normalization" || view.source !== "activity" && view.source !== "normalizedActivity" || view.baseUrl !== null && (typeof view.baseUrl !== "string" || !URL.canParse(view.baseUrl)) || !Array.isArray(view.contexts) || typeof view.expandedDigest !== "string") return null;
+	return view;
+}
+/**
+* Restores a view from a queued message without loading any context.
+* @param view The serialized view.
+* @param message The fields of the message the view refers to.
+* @returns The restored view.
+* @throws {ContextSnapshotMissError} If the view cannot be replayed exactly.
+* @internal
+*/
+async function restoreVerifiedActivityView(view, message) {
+	const loader = createSnapshotOnlyLoader(await deserializeContextSnapshot(view.contexts), view.policy);
+	if (view.source === "normalizedActivity" && message.normalizedActivity == null) throw new ContextSnapshotMissError("(normalizedActivity)", "the normalized activity is missing");
+	const document = require_http.detachSignature(view.source === "activity" ? message.activity : message.normalizedActivity);
+	const expanded = await expandDocument(document, loader);
+	if (await digestExpandedDocument(expanded) !== view.expandedDigest) throw new ContextSnapshotMissError("(activity)", "the interpretation does not match the authenticated one");
+	return {
+		document,
+		loader,
+		expanded,
+		baseUrl: view.baseUrl == null ? null : new URL(view.baseUrl)
+	};
+}
+//#endregion
 //#region src/federation/keycache.ts
 const Temporal$9 = require_http.Temporal;
 const KEY_CACHE_GENERATION = "3";
@@ -3648,9 +4320,10 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 *
 * @param parameters The parameters for sending the activity.
 *                   See also {@link SendActivityParameters}.
+* @param deps The dependencies, for tests.
 * @throws {Error} If the activity fails to send.
 */
-function sendActivity(options) {
+function sendActivity(options, deps = {}) {
 	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	return tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.send_activity", {
 		kind: _opentelemetry_api.SpanKind.CLIENT,
@@ -3666,7 +4339,7 @@ function sendActivity(options) {
 			}, () => sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span));
+			}, span, deps));
 		} catch (e) {
 			span.setStatus({
 				code: _opentelemetry_api.SpanStatusCode.ERROR,
@@ -3751,13 +4424,14 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
+		if (truncated) reader.cancel().catch(() => {});
 		reader.releaseLock();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -3766,9 +4440,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = require_http.getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+	const openUnvalidatedHop = deps.openHop ?? (allowPrivateAddress ? _fedify_vocab_runtime_internal.openDirectFetch : (url) => (0, _fedify_vocab_runtime_internal.openPublicFetch)(url));
+	async function openHop(url) {
+		let session;
+		try {
+			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof _fedify_vocab_runtime.UrlError && error.reason === "dns") {
 				logger.error("DNS resolution failed for URL: {url}", {
@@ -3785,82 +4461,90 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			});
 			throw error;
 		}
+		return session;
 	}
+	let initialSession;
 	try {
-		await validateUrl(inbox.href);
+		initialSession = await openHop(inbox.href);
 	} catch (error) {
 		if (error instanceof _fedify_vocab_runtime.FetchError) federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
 		throw error;
 	}
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
-	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
-	});
-	let response;
+	let initialPending = true;
+	const openDeliveryHop = (url) => {
+		if (initialPending) {
+			initialPending = false;
+			return Promise.resolve(initialSession);
+		}
+		return openHop(url);
+	};
 	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
+		headers = new Headers(headers);
+		headers.set("Content-Type", "application/activity+json");
+		const request = new Request(inbox, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(activity),
+			redirect: "manual"
 		});
-	} catch (error) {
-		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+		let rsaKey = null;
+		for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+			rsaKey = key;
+			break;
+		}
+		if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
 			activityId,
+			inbox: inbox.href
+		});
+		else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			inbox: inbox.href,
-			error: failure
+			keys: keys.map((pair) => ({
+				keyId: pair.keyId.href,
+				privateKey: pair.privateKey
+			}))
 		});
-		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
-		throw failure;
-	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+		let outcome;
+		try {
+			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox)) : await require_http.doubleKnockScoped(request, rsaKey, {
+				tracerProvider,
+				specDeterminer
+			}, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox));
+		} catch (error) {
+			const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
+			logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 				activityId,
 				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
+				error: failure
 			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+			federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
+			throw failure;
+		}
+		try {
+			if (!outcome.ok) {
+				const { status, statusText, error, responseHeaders } = outcome;
+				logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+					activityId,
+					inbox: inbox.href,
+					status,
+					statusText,
+					error
+				});
+				throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+			}
+			deliverySuccess = true;
+			const eventAttributes = {
+				"activitypub.inbox.url": inbox.href,
+				"activitypub.activity.id": activityId ?? ""
+			};
+			if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+			const actorId = getActivityActorId(activity);
+			if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+			span.addEvent("activitypub.activity.sent", eventAttributes);
+		} finally {
+			federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), deliverySuccess, activityType);
 		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
 	} finally {
-		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), deliverySuccess, activityType);
+		if (initialPending) await initialSession.close();
 	}
 }
 function createFetchError(url, cause) {
@@ -3868,10 +4552,75 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"outbox"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Reads what is needed from the final response of a delivery while its
+* session is open: the body of a successful response is cancelled, and at
+* most 1 KiB of an error response body is read.
+*/
+async function consumeSendActivityResponse(response, inbox) {
+	if (response.ok) {
+		cancelResponseBody(response, response.url || inbox.href);
+		return { ok: true };
+	}
+	let error;
+	try {
+		error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+	} catch (_) {
+		error = "";
+	}
+	return {
+		ok: false,
+		status: response.status,
+		statusText: response.statusText,
+		error,
+		responseHeaders: new Headers(response.headers)
+	};
+}
+/**
+* Sends a request without signing it, following redirects manually like the
+* Fetch standard does.  Every hop is opened with `openHop()`, which validates
+* the destination, after the previous hop is closed.  The final response is
+* passed to `consume()`, and its session is closed after that.
+* This is exported only for tests; it is not exported from any entry point.
+* @param request The request to send.
+* @param openHop The function to open a session for each hop.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function fetchWithValidatedRedirects(request, openHop, consume) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
 	let body = await request.clone().text();
 	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
+		const session = await openHop(request.url);
+		let response;
+		try {
+			response = await session.fetch(request, { redirect: "manual" });
+		} catch (error) {
+			await closeAfterError(session, logger);
+			throw error;
+		}
 		const location = response.headers.get("Location");
 		if (![
 			301,
@@ -3879,11 +4628,21 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
+		].includes(response.status) || location == null) try {
+			return await consume(response);
+		} catch (error) {
+			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+				url: request.url,
+				error
+			});
+			throw error;
+		} finally {
+			await session.close();
+		}
+		cancelResponseBody(response, request.url);
+		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
 		const url = new URL(location, request.url);
-		await validateUrl(url.href);
 		const headers = new Headers(request.headers);
 		if (url.origin !== new URL(request.url).origin) {
 			headers.delete("Authorization");
@@ -3911,6 +4670,16 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 		});
 	}
 }
+async function closeAfterError(session, logger) {
+	try {
+		await session.close();
+	} catch (error) {
+		logger.debug("Failed to close the session for {url}: {error}", {
+			url: session.url.href,
+			error
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -5405,11 +6174,12 @@ async function handleInbox(request, options) {
 	}, async (span) => {
 		if (options.recipient != null) span.setAttribute("fedify.inbox.recipient", options.recipient);
 		const spanContext = span.spanContext();
+		const snapshot = createContextSnapshot(options.context.contextLoader);
 		try {
 			return await (0, _logtape_logtape.withContext)({
 				traceId: spanContext.traceId,
 				spanId: spanContext.spanId
-			}, () => handleInboxInternal(request, options, span));
+			}, () => handleInboxInternal(request, options, span, snapshot));
 		} catch (e) {
 			options.observation.hasException = true;
 			span.setStatus({
@@ -5418,6 +6188,7 @@ async function handleInbox(request, options) {
 			});
 			throw e;
 		} finally {
+			snapshot.release();
 			options.observation.project(span);
 			span.end();
 		}
@@ -5429,9 +6200,10 @@ async function handleInbox(request, options) {
 * @param request The HTTP request.
 * @param options The parameters for handling the inbox.
 * @param span The OpenTelemetry span for tracing.
+* @param snapshot The context snapshot of the delivery.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleInboxInternal(request, parameters, span) {
+async function handleInboxInternal(request, parameters, span, snapshot) {
 	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const observation = parameters.observation;
 	const signatureObservation = { [require_http.verificationObservation]: observation.verification };
@@ -5545,6 +6317,8 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		keyTtl: publicKeyTtl
 	});
+	const standardLoader = snapshot.loader("standard");
+	const normalizationLoader = snapshot.loader("normalization");
 	const jsonWithoutSig = require_http.detachSignature(json);
 	const hasLdSignature = require_http.hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -5580,9 +6354,10 @@ async function handleInboxInternal(request, parameters, span) {
 	let compactedJson = json;
 	let compactedJsonWithoutSig = jsonWithoutSig;
 	let ldSigVerified = false;
+	let ldSigKey = null;
 	if (hasLdSignature) {
 		try {
-			compactedJson = await require_http.compactJsonLd(json, ctx.contextLoader);
+			compactedJson = await require_http.compactJsonLd(json, normalizationLoader);
 		} catch (error) {
 			if (isInvalidJsonLdError(error)) {
 				logger.error("Failed to parse JSON-LD:\n{error}", {
@@ -5618,16 +6393,18 @@ async function handleInboxInternal(request, parameters, span) {
 		if (compactedJson !== json) {
 			compactedJsonWithoutSig = require_http.detachSignature(compactedJson);
 			try {
-				ldSigVerified = await require_http.verifyCompactJsonLd(compactedJson, {
+				const ldResult = await require_http.verifyCompactJsonLdDetailed(compactedJson, {
 					...signatureObservation,
-					contextLoader: ctx.contextLoader,
+					contextLoader: normalizationLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
 					meterProvider,
 					tracerProvider
 				});
+				ldSigVerified = ldResult.verified;
+				ldSigKey = ldResult.key;
 			} catch (error) {
-				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 				if (isInvalidJsonLdError(error)) {
 					logger.error("Failed to parse JSON-LD:\n{error}", {
 						recipient,
@@ -5645,12 +6422,12 @@ async function handleInboxInternal(request, parameters, span) {
 				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 				if (!skipSignatureVerification) try {
 					await _fedify_vocab.Object.fromJsonLd(compactedJson, {
-						contextLoader: require_http.getNormalizationContextLoader(ctx.contextLoader),
+						contextLoader: normalizationLoader,
 						documentLoader: ctx.documentLoader,
 						tracerProvider
 					});
 				} catch (parseError) {
-					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(parseError);
+					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(parseError);
 					if (isInvalidJsonLdError(parseError)) {
 						logger.error("Failed to parse JSON-LD:\n{error}", {
 							recipient,
@@ -5674,6 +6451,33 @@ async function handleInboxInternal(request, parameters, span) {
 	let activity = null;
 	let activityVerified = false;
 	let proofVerified = false;
+	let documentSigners = [];
+	let requestSigners = [];
+	let viewSource;
+	const rawViewSource = {
+		policy: "standard",
+		source: "activity",
+		document: jsonWithoutSig,
+		baseUrl: null
+	};
+	const isActorlessCandidate = async (candidate, source) => {
+		if (skipSignatureVerification) return false;
+		if (inboxListeners?.dispatchWithClass(candidate)?.options.allowActorless !== true) return false;
+		try {
+			return getActorPresence(await expandDocument(source.document, snapshot.loader(source.policy))) === "absent";
+		} catch {
+			return false;
+		}
+	};
+	const verifyProofs = (contextLoader = standardLoader) => require_http.verifyObjectDetailed(_fedify_vocab.Activity, jsonWithoutSig, {
+		...signatureObservation,
+		contextLoader,
+		documentLoader: ctx.documentLoader,
+		keyCache,
+		meterProvider,
+		tracerProvider,
+		verifyPortableObject: ctx.verifyPortableObject
+	});
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -5682,18 +6486,49 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await _fedify_vocab.Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
-				contextLoader: require_http.getNormalizationContextLoader(ctx.contextLoader)
+				contextLoader: normalizationLoader
 			});
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		viewSource = {
+			policy: "normalization",
+			source: "normalizedActivity",
+			document: compactedJsonWithoutSig,
+			baseUrl: null
+		};
+		if (ldSigKey?.ownerId != null) documentSigners = [{
+			kind: "actor",
+			id: ldSigKey.ownerId,
+			mechanism: "linkedDataSignatures",
+			keyId: ldSigKey.id
+		}];
+		if (await isActorlessCandidate(activity, viewSource)) {
+			let result = null;
+			try {
+				result = await verifyProofs();
+			} catch (error) {
+				if (!isPermanentActivityParseError(error)) throw error;
+				logger.debug("Failed to verify the Object Integrity Proofs of the activity without an actor:\n{error}", {
+					recipient,
+					error
+				});
+			}
+			if (result?.status === "unavailable") throw result.error;
+			if (result?.status === "verified" && result.signers.length > 0) {
+				activity = observation.activity = result.object;
+				documentSigners = toProofPrincipals(result.signers);
+				viewSource = rawViewSource;
+				proofVerified = true;
+			}
+		}
 		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
 				...signatureObservation,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -5711,18 +6546,11 @@ async function handleInboxInternal(request, parameters, span) {
 			recipient,
 			json
 		});
+		let proofResult;
 		try {
-			activity = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
-				...signatureObservation,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
-				documentLoader: ctx.documentLoader,
-				keyCache,
-				meterProvider,
-				tracerProvider,
-				verifyPortableObject: ctx.verifyPortableObject
-			});
+			proofResult = await verifyProofs();
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, standardLoader)) return await respondInvalidActivity(error);
 			if (deferredLdSignatureError != null) {
 				logger.debug("Object Integrity Proof fallback did not supersede a deferred Linked Data Signature failure:\n{error}", {
 					recipient,
@@ -5758,6 +6586,22 @@ async function handleInboxInternal(request, parameters, span) {
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
 			});
 		}
+		if (proofResult.status === "verified") if (proofResult.signers.length < 1 && await isActorlessCandidate(proofResult.object, rawViewSource)) activity = null;
+		else {
+			activity = proofResult.object;
+			documentSigners = toProofPrincipals(proofResult.signers);
+			viewSource = rawViewSource;
+		}
+		else if (proofResult.status === "unavailable") {
+			let parsed = null;
+			try {
+				parsed = await _fedify_vocab.Activity.fromJsonLd(jsonWithoutSig, {
+					...ctx,
+					contextLoader: standardLoader
+				});
+			} catch {}
+			if (parsed != null && await isActorlessCandidate(parsed, rawViewSource)) throw proofResult.error;
+		}
 		if (activity == null) logger.debug("Object Integrity Proofs are not verified.", {
 			recipient,
 			activity: json
@@ -5887,14 +6731,28 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await _fedify_vocab.Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader)
+				contextLoader: standardLoader
 			});
 		} catch (error) {
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
+		viewSource = rawViewSource;
 	}
 	observation.activity = activity;
+	let view;
+	try {
+		view = await buildVerifiedActivityView(snapshot, viewSource ?? rawViewSource);
+	} catch (error) {
+		if (!isPermanentActivityParseError(error)) throw error;
+		return await respondInvalidActivity(error);
+	}
+	const actorless = !skipSignatureVerification && getActorPresence(view.expanded) === "absent" && inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true;
+	span.setAttribute("activitypub.activity.actorless", actorless);
+	if (actorless && httpSigKey != null) {
+		const principal = getHttpKeyPrincipal(httpSigKey);
+		if (principal != null) requestSigners = [principal];
+	}
 	observation.stage = "policy";
 	observation.result = {
 		disposition: "rejected",
@@ -5938,7 +6796,7 @@ async function handleInboxInternal(request, parameters, span) {
 		const rejection = await require_http.observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
 			const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
 				[require_http.verificationObservation]: verification,
-				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -5976,7 +6834,7 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 	}
-	if (httpSigKey != null && !await require_portable_collection.doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !actorless && !await require_portable_collection.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		observation.authentication = {
 			status: "rejected",
@@ -6002,6 +6860,66 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (httpSigKey != null && !actorless && activity.actorId != null) requestSigners = [{
+		kind: "actor",
+		id: activity.actorId,
+		mechanism: "httpSignatures",
+		keyId: httpSigKey.id
+	}];
+	if (actorless) {
+		const check = checkActorlessActivity(activity, {
+			verified: true,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: [],
+			baseUrl: null
+		});
+		if (check.status === "noAuthenticatedPrincipal") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: { type: "noAuthenticatedPrincipal" }
+			};
+			logger.error("The activity {activityId} declares no actor, and no principal is authenticated for it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href
+			});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: "No principal is authenticated for the activity."
+			});
+			return new Response("No principal is authenticated for the activity.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		} else if (check.status === "activityOriginMismatch") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: {
+					type: "activityOriginMismatch",
+					activityId: new URL(activity.id.href),
+					actorIds: check.principals.map((principal) => principal.id)
+				}
+			};
+			logger.error("The activity ({activityId}) does not have the same origin as the principals that authenticated it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href,
+				principals: check.principals.map((principal) => principal.id.href)
+			});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: `The activity (${activity.id?.href}) does not have the same origin as the principals that authenticated it.`
+			});
+			return new Response("The activity and its signers do not have the same origin.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (!skipSignatureVerification) {
 		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
 		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
@@ -6061,7 +6979,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
-	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+	if (!skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 		observation.authentication = {
 			status: "rejected",
 			reason: {
@@ -6090,7 +7008,7 @@ async function handleInboxInternal(request, parameters, span) {
 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
 	};
 	observation.stage = "dispatch";
-	if (activity.actorId == null) {
+	if (!actorless && activity.actorId == null) {
 		observation.result = {
 			disposition: "rejected",
 			reason: "missingActor"
@@ -6114,6 +7032,17 @@ async function handleInboxInternal(request, parameters, span) {
 		originalJson: json,
 		normalizedActivity: hasLdSignature && compactedJson !== json ? compactedJson : void 0,
 		ldSignatureVerified: hasLdSignature ? ldSigVerified : void 0,
+		authentication: createAuthenticationEvidence({
+			verified: !skipSignatureVerification,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: deepFreeze(view.expanded),
+			baseUrl: null
+		}),
+		verifiedView: view.view,
+		replayable: view.replayable,
+		actorless,
 		activity,
 		recipient,
 		inboxListeners,
@@ -6838,6 +7767,42 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
+* Turns the signers of verified Object Integrity Proofs into principals.
+*/
+function toProofPrincipals(signers) {
+	return signers.map((signer) => ({
+		kind: signer.kind,
+		id: signer.id,
+		mechanism: "objectIntegrityProofs",
+		keyId: signer.keyId
+	}));
+}
+/**
+* Gets the principal of an HTTP Signature key, whose owner was confirmed by
+* the owner's own document, or by the signed document of a portable actor,
+* when the key was fetched.
+*/
+function getHttpKeyPrincipal(key) {
+	const evidence = require_http.getVerifiedKeyOwnerEvidence(key);
+	if (evidence != null) try {
+		return {
+			kind: "actor",
+			id: (0, _fedify_vocab_runtime.parseIri)(evidence.ownerId),
+			mechanism: "httpSignatures",
+			keyId: key.id
+		};
+	} catch {
+		return null;
+	}
+	if (key.ownerId == null || require_http.isPortableId(key.ownerId)) return null;
+	return {
+		kind: "actor",
+		id: key.ownerId,
+		mechanism: "httpSignatures",
+		keyId: key.id
+	};
+}
+/**
 * Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
 * actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
 * URI, and it is owned by a portable actor, which only the portable actor's
@@ -9429,24 +10394,102 @@ var FederationImpl = class extends FederationBuilderImpl {
 			let dispatched;
 			let parseInput = void 0;
 			let parseContextLoader = context.contextLoader;
+			let authentication = getEmptyAuthenticationEvidence();
+			let actorPresence = "present";
+			if (message.verifiedView !== void 0) {
+				const view = parseSerializedVerifiedActivityView(message.verifiedView);
+				let restored;
+				let restoredAuthentication = null;
+				let failure;
+				if (view == null) failure = /* @__PURE__ */ new TypeError("The queued activity has a malformed verified view.");
+				else try {
+					if (view.source === "normalizedActivity") require_http.assertSafeJsonLd(message.normalizedActivity);
+					restored = await restoreVerifiedActivityView(view, message);
+				} catch (error) {
+					if (!(error instanceof ContextSnapshotMissError) && !isPermanentInboxParseError(error)) {
+						await handleRetriableFailure(error);
+						return;
+					}
+					failure = error;
+				}
+				if (restored != null) {
+					const expandedActivity = deepFreeze(restored.expanded);
+					restoredAuthentication = message.authentication === void 0 ? createAuthenticationEvidence({
+						...getEmptyAuthenticationEvidence(),
+						expandedActivity,
+						baseUrl: restored.baseUrl
+					}) : deserializeAuthentication(message.authentication, expandedActivity, restored.baseUrl);
+					if (restoredAuthentication == null) failure = /* @__PURE__ */ new TypeError("The queued activity has malformed authentication evidence.");
+				}
+				if (failure != null || restored == null || restoredAuthentication == null) {
+					await reportInboxError(failure);
+					logger.error("Failed to replay the queued incoming activity:\n{error}", {
+						error: failure,
+						trial: message.attempt,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: String(failure)
+					});
+					listenerSpan.end();
+					return;
+				}
+				authentication = restoredAuthentication;
+				actorPresence = getActorPresence(restored.expanded);
+				const policy = view.policy;
+				const replayLoader = createReleasableLoader(restored.loader, policy === "normalization" ? require_http.getNormalizationContextLoader(context.contextLoader) : require_http.wrapContextLoaderForJsonLd(context.contextLoader), policy);
+				parseInput = restored.document;
+				parseContextLoader = restored.loader;
+				try {
+					activity = await _fedify_vocab.Activity.fromJsonLd(restored.document, {
+						...context,
+						contextLoader: replayLoader.loader,
+						...restored.baseUrl == null ? {} : { baseUrl: restored.baseUrl }
+					});
+				} catch (error) {
+					if (isPermanentInboxParseError(error)) {
+						await reportInboxError(error);
+						logger.error("Failed to parse the queued incoming activity:\n{error}", {
+							error,
+							trial: message.attempt,
+							activity: message.activity,
+							recipient: message.identifier
+						});
+						listenerSpan.setStatus({
+							code: _opentelemetry_api.SpanStatusCode.ERROR,
+							message: String(error)
+						});
+						listenerSpan.end();
+						return;
+					}
+					await handleRetriableFailure(error);
+					return;
+				} finally {
+					replayLoader.release();
+				}
+			}
 			try {
-				const hasSignatureField = require_http.hasSignature(message.activity);
-				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
-				const parseContext = hasSignatureField ? {
-					...context,
-					contextLoader: require_http.getNormalizationContextLoader(context.contextLoader)
-				} : {
-					...context,
-					contextLoader: require_http.wrapContextLoaderForJsonLd(context.contextLoader)
-				};
-				parseContextLoader = parseContext.contextLoader;
-				let normalizedActivity;
-				if (shouldParseFromNormalizedSignedPayload) {
-					normalizedActivity = message.normalizedActivity ?? await require_http.compactJsonLd(message.activity, context.contextLoader);
-					require_http.assertSafeJsonLd(normalizedActivity);
+				if (activity == null) {
+					const hasSignatureField = require_http.hasSignature(message.activity);
+					const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
+					const parseContext = hasSignatureField ? {
+						...context,
+						contextLoader: require_http.getNormalizationContextLoader(context.contextLoader)
+					} : {
+						...context,
+						contextLoader: require_http.wrapContextLoaderForJsonLd(context.contextLoader)
+					};
+					parseContextLoader = parseContext.contextLoader;
+					let normalizedActivity;
+					if (shouldParseFromNormalizedSignedPayload) {
+						normalizedActivity = message.normalizedActivity ?? await require_http.compactJsonLd(message.activity, context.contextLoader);
+						require_http.assertSafeJsonLd(normalizedActivity);
+					}
+					parseInput = shouldParseFromNormalizedSignedPayload ? require_http.detachSignature(normalizedActivity) : hasSignatureField ? require_http.detachSignature(message.activity) : message.activity;
+					activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				}
-				parseInput = shouldParseFromNormalizedSignedPayload ? require_http.detachSignature(normalizedActivity) : hasSignatureField ? require_http.detachSignature(message.activity) : message.activity;
-				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				activityType = (0, _fedify_vocab.getTypeId)(activity).href;
 				span.setAttribute("activitypub.activity.type", activityType);
 				listenerSpan.setAttribute("activitypub.activity.type", activityType);
@@ -9455,7 +10498,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 					span.setAttribute("activitypub.activity.id", activity.id.href);
 					listenerSpan.setAttribute("activitypub.activity.id", activity.id.href);
 				}
-				if (activity.actorId == null) {
+				const actorless = actorPresence === "absent" && !this.skipSignatureVerification && authentication.verified && this.inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true && isActorlessActivityAuthenticated(activity, authentication);
+				if (activity.actorId == null && !actorless) {
 					logger.error("Missing actor in queued incoming activity.", {
 						activityId: activity.id?.href,
 						activity: message.activity,
@@ -9469,7 +10513,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+				if (!this.skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
 						activityId: activity.id.href,
 						actorIds: activity.actorIds.map((actor) => actor.href),
@@ -9484,22 +10528,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				cacheKey = activity.id == null ? null : [
-					...this.kvPrefixes.activityIdempotence,
-					context.origin,
-					activity.id.href
-				];
-				if (cacheKey != null) {
-					if (await this.kv.get(cacheKey) === true) {
-						logger.debug("Activity {activityId} has already been processed.", {
-							activityId: activity.id?.href,
-							activity: message.activity,
-							recipient: message.identifier
-						});
-						require_http.recordInboxActivity(this.meterProvider, "rejected", activityType);
-						listenerSpan.end();
-						return;
-					}
+				const parsedActivity = activity;
+				const parsedActivityType = activityType;
+				cacheKey = await getInboxIdempotencyKey(this.idempotencyStrategy, () => context.toInboxContext(message.identifier, message.activity, parsedActivity.id?.href, parsedActivityType, { authentication }), activity, context.origin, message.identifier, this.kvPrefixes.activityIdempotence);
+				if (await isInboxActivityProcessed(this.kv, cacheKey, activity, context.origin, this.kvPrefixes.activityIdempotence)) {
+					logger.debug("Activity {activityId} has already been processed.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					require_http.recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
 				}
 				dispatched = this.inboxListeners?.dispatchWithClass(activity);
 			} catch (error) {
@@ -9558,7 +10598,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			try {
 				const started = performance.now();
 				try {
-					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType, { authentication }), activity);
 				} finally {
 					this.metrics.recordInboxProcessingDuration(activityType, require_http.getDurationMs(started));
 				}
@@ -9960,7 +11000,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		onNotAcceptable ??= notAcceptable;
 		onUnauthorized ??= unauthorized;
 		const url = new URL(request.url);
-		const route = this.router.route(url.pathname);
+		const route = this.router.route(url.pathname, { allowUnencodedColon: true });
 		if (route == null) {
 			const media = this.hashlinkMediaDispatcher == null ? null : parseHashlinkGatewayRequest(url);
 			if (media != null) return await this.#fetchHashlinkMedia(request, media, {
@@ -10865,7 +11905,7 @@ var ContextImpl = class ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
 		});
 	}
-	toInboxContext(recipient, activity, activityId, activityType) {
+	toInboxContext(recipient, activity, activityId, activityType, metadata) {
 		return new InboxContextImpl(recipient, activity, activityId, activityType, {
 			url: this.url,
 			federation: this.federation,
@@ -10873,7 +11913,7 @@ var ContextImpl = class ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, metadata?.authentication);
 	}
 	toOutboxContext(identifier, activity, activityId, activityType) {
 		return new OutboxContextImpl(identifier, activity, activityId, activityType, {
@@ -11488,12 +12528,20 @@ var ContextImpl = class ContextImpl {
 		});
 	}
 	async routeActivityInternal(recipient, activity, options = {}, span) {
+		const snapshot = createContextSnapshot(options.contextLoader ?? this.contextLoader);
+		try {
+			return await this.#routeActivityWithSnapshot(recipient, activity, options, span, snapshot);
+		} finally {
+			snapshot.release();
+		}
+	}
+	async #routeActivityWithSnapshot(recipient, activity, options, span, snapshot) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
 			"inbox"
 		]);
-		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const contextLoader = snapshot.loader("standard");
 		let json = await activity.toJsonLd({ contextLoader });
 		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
 			documentLoader: this.documentLoader,
@@ -11501,13 +12549,19 @@ var ContextImpl = class ContextImpl {
 			tracerProvider: this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
 		});
-		if (await require_http.verifyObject(_fedify_vocab.Activity, json, {
+		let documentSigners = [];
+		let originAuthenticated = [];
+		let viewSource;
+		let fetchedView;
+		const document = require_http.detachSignature(json);
+		const verified = await require_http.verifyObjectDetailed(_fedify_vocab.Activity, document, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			meterProvider: this.meterProvider,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyCache
-		}) == null) {
+		});
+		if (verified.status !== "verified") {
 			logger.debug("Object Integrity Proofs are not verified.", {
 				recipient,
 				activity: json
@@ -11519,8 +12573,29 @@ var ContextImpl = class ContextImpl {
 				});
 				return false;
 			}
-			const fetched = await this.lookupObject(activity.id, options);
-			if (fetched == null) {
+			let candidate;
+			let candidateView;
+			const verifications = /* @__PURE__ */ new WeakMap();
+			const fetched = await this.lookupObject(activity.id, {
+				...options,
+				contextLoader,
+				verifyPortableObject: async (document, verifierOptions) => {
+					const result = await this.verifyPortableObject(document, verifierOptions);
+					if (document != null && typeof document === "object") verifications.set(document, result);
+					return result;
+				},
+				[_fedify_vocab.lookupObserver]: { accept: async (accepted) => {
+					candidate = accepted;
+					candidateView = await buildVerifiedActivityView(createContextSnapshot(accepted.contextLoader), {
+						policy: "standard",
+						source: "activity",
+						document: require_http.detachSignature(accepted.document),
+						baseUrl: accepted.baseUrl
+					});
+					return true;
+				} }
+			});
+			if (fetched == null || candidate == null || candidateView == null) {
 				logger.debug("Failed to fetch the remote activity object {activityId}.", {
 					recipient,
 					activity: json,
@@ -11556,11 +12631,50 @@ var ContextImpl = class ContextImpl {
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
-			json = await fetched.toJsonLd({ contextLoader });
-		} else logger.debug("Object Integrity Proofs are verified.", {
-			recipient,
-			activity: json
-		});
+			json = candidate.document;
+			fetchedView = candidateView;
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document: require_http.detachSignature(candidate.document),
+				baseUrl: candidate.baseUrl
+			};
+			if (require_http.isPortableId(fetched.id)) {
+				const result = verifications.get(candidate.document);
+				if (result?.verified === true && result.method === "proof") documentSigners = result.keys.flatMap((key) => {
+					const signer = require_http.getProofSigner(key);
+					return signer == null ? [] : [{
+						kind: signer.kind,
+						id: signer.id,
+						mechanism: "objectIntegrityProofs",
+						keyId: signer.keyId
+					}];
+				});
+			} else originAuthenticated = fetched.actorIds.map((actorId) => ({
+				kind: "actor",
+				id: actorId,
+				mechanism: "origin",
+				keyId: null
+			}));
+		} else {
+			logger.debug("Object Integrity Proofs are verified.", {
+				recipient,
+				activity: json
+			});
+			activity = verified.object;
+			documentSigners = verified.signers.map((signer) => ({
+				kind: signer.kind,
+				id: signer.id,
+				mechanism: "objectIntegrityProofs",
+				keyId: signer.keyId
+			}));
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document,
+				baseUrl: null
+			};
+		}
 		if (activity.actorId == null) {
 			logger.debug("Activity is missing an actor; unable to verify.", {
 				recipient,
@@ -11575,10 +12689,21 @@ var ContextImpl = class ContextImpl {
 			});
 			return false;
 		}
+		const view = fetchedView ?? await buildVerifiedActivityView(snapshot, viewSource);
 		const routeResult = await routeActivity({
 			context: this,
 			json,
 			ldSignatureVerified: false,
+			authentication: createAuthenticationEvidence({
+				verified: true,
+				requestSigners: [],
+				documentSigners,
+				originAuthenticated,
+				expandedActivity: deepFreeze(view.expanded),
+				baseUrl: viewSource.baseUrl
+			}),
+			verifiedView: view.view,
+			replayable: view.replayable,
 			activity,
 			recipient,
 			inboxListeners: this.federation.inboxListeners,
@@ -11694,52 +12819,92 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		if (object instanceof _fedify_vocab.Tombstone && !(object instanceof cls) && options?.tombstone !== "passthrough") return null;
 		return object;
 	}
-	#signedKey = void 0;
+	#signedKey = null;
+	#signedKeyOwner = null;
+	#signatureChecks = /* @__PURE__ */ new WeakMap();
+	#getSignatureCheck(documentLoader, contextLoader) {
+		let checks = this.#signatureChecks.get(documentLoader);
+		if (checks == null) {
+			checks = /* @__PURE__ */ new WeakMap();
+			this.#signatureChecks.set(documentLoader, checks);
+		}
+		let check = checks.get(contextLoader);
+		if (check == null) {
+			check = {};
+			checks.set(contextLoader, check);
+		}
+		return check;
+	}
 	async getSignedKey(options = {}) {
 		if (this.#signedKey != null) return this.#signedKey;
-		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
-			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader,
+		const documentLoader = options.documentLoader ?? this.documentLoader;
+		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const check = this.#getSignatureCheck(documentLoader, contextLoader);
+		if (check.key != null) return check.key;
+		const keyCache = documentLoader === this.documentLoader && contextLoader === this.contextLoader ? new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
+			documentLoader,
+			contextLoader,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
-		});
-		return this.#signedKey = await require_http.verifyRequest(this.request, {
+		}) : void 0;
+		const promise = require_http.verifyRequest(this.request, {
 			...this,
-			contextLoader: options.contextLoader ?? this.contextLoader,
-			documentLoader: options.documentLoader ?? this.documentLoader,
+			contextLoader,
+			documentLoader,
 			timeWindow: this.federation.signatureTimeWindow,
 			maxSignatures: this.federation.maxHttpSignatures,
+			keyCache,
 			meterProvider: this.meterProvider,
-			tracerProvider: options.tracerProvider ?? this.tracerProvider,
-			keyCache
+			tracerProvider: options.tracerProvider ?? this.tracerProvider
+		}).then((key) => {
+			if (key != null) this.#signedKey ??= key;
+			return key;
+		}).catch((error) => {
+			if (check.key === promise) check.key = void 0;
+			throw error;
 		});
+		check.key = promise;
+		return await promise;
 	}
-	#signedKeyOwner = void 0;
 	async getSignedKeyOwner(options = {}) {
 		if (this.#signedKeyOwner != null) return this.#signedKeyOwner;
-		const key = await this.getSignedKey(options);
-		if (key == null) return this.#signedKeyOwner = null;
-		try {
-			return this.#signedKeyOwner = await require_portable_collection.getKeyOwner(key, {
-				contextLoader: options.contextLoader ?? this.contextLoader,
-				documentLoader: options.documentLoader ?? this.documentLoader,
-				tracerProvider: options.tracerProvider ?? this.tracerProvider
-			});
-		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.FetchError) {
-				(0, _logtape_logtape.getLogger)([
-					"fedify",
-					"federation",
-					"actor"
-				]).warn("Failed to fetch the key owner {keyOwner} of {keyId} while verifying the request signature; treating the request as unauthenticated: {error}", {
-					keyId: key.id?.href,
-					keyOwner: error.url.href,
-					error
-				});
-				return this.#signedKeyOwner = null;
+		const normalizedOptions = {
+			documentLoader: options.documentLoader ?? this.documentLoader,
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			tracerProvider: options.tracerProvider ?? this.tracerProvider
+		};
+		const check = this.#getSignatureCheck(normalizedOptions.documentLoader, normalizedOptions.contextLoader);
+		if (check.owner != null) return check.owner;
+		const promise = this.getSignedKey(normalizedOptions).then(async (key) => {
+			if (key == null) {
+				if (check.owner === promise) check.owner = void 0;
+				return null;
+			}
+			try {
+				const owner = await require_portable_collection.getKeyOwner(key, normalizedOptions);
+				if (owner != null) this.#signedKeyOwner ??= owner;
+				return owner;
+			} catch (error) {
+				if (error instanceof _fedify_vocab_runtime.FetchError) {
+					(0, _logtape_logtape.getLogger)([
+						"fedify",
+						"federation",
+						"actor"
+					]).warn("Failed to fetch the key owner {keyOwner} of {keyId} while verifying the request signature; treating the request as unauthenticated: {error}", {
+						keyId: key.id?.href,
+						keyOwner: error.url.href,
+						error
+					});
+					return null;
+				}
+				throw error;
 			}
+		}).catch((error) => {
+			if (check.owner === promise) check.owner = void 0;
 			throw error;
-		}
+		});
+		check.owner = promise;
+		return await promise;
 	}
 	async isSignedByAudience(object, options = {}) {
 		return await isInAudience(object, null) || await isInAudience(object, await this.getSignedKeyOwner(options), options);
@@ -11929,12 +13094,14 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 	activity;
 	activityId;
 	activityType;
-	constructor(recipient, activity, activityId, activityType, options) {
+	authentication;
+	constructor(recipient, activity, activityId, activityType, options, authentication) {
 		super(options);
 		this.recipient = recipient;
 		this.activity = activity;
 		this.activityId = activityId;
 		this.activityType = activityType;
+		this.authentication = authentication ?? getEmptyAuthenticationEvidence();
 	}
 	clone(data) {
 		return new InboxContextImpl(this.recipient, this.activity, this.activityId, this.activityType, {
@@ -11944,7 +13111,7 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, this.authentication);
 	}
 	forwardActivity(forwarder, recipients, options) {
 		return forwardActivity(this, "inbox", forwarder, recipients, options).then(() => void 0);
@@ -12237,6 +13404,11 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 	* @since 2.4.0
 	*/
 	atomicEnqueueMany;
+	/**
+	* Inherits the message size limit from the wrapped queue.
+	* @since 2.5.0
+	*/
+	maxMessageSize;
 	getDepth;
 	/**
 	* Tracks which ordering keys are currently being processed to ensure
@@ -12262,6 +13434,7 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 		this.workers = workers;
 		this.nativeRetrial = queue.nativeRetrial;
 		this.nativeDeduplication = queue.nativeDeduplication;
+		this.maxMessageSize = queue.maxMessageSize;
 		this.atomicEnqueueMany = queue.enqueueMany == null ? false : queue.atomicEnqueueMany;
 		if (queue.getDepth != null) this.getDepth = () => queue.getDepth();
 	}
@@ -12567,6 +13740,12 @@ Object.defineProperty(exports, "handleWebFinger", {
 		return handleWebFinger;
 	}
 });
+Object.defineProperty(exports, "isActorAuthenticated", {
+	enumerable: true,
+	get: function() {
+		return isActorAuthenticated;
+	}
+});
 Object.defineProperty(exports, "normalizeCircuitBreakerOptions", {
 	enumerable: true,
 	get: function() {