@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/{middleware-N9eM16XE.js → middleware-BHb5toqA.js}

@@ -2,20 +2,22 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as getFederationMetrics, A as detachSignature, At as isPortableId, B as wrapContextLoaderForJsonLd, Ct as getAuthenticationOrigin, Dt as getRawCanonicalPortableId, E as assertSafeJsonLd, Et as getPortableDid, F as isInvalidUrlTypeError, Ft as name, I as signJsonLd, It as version, K as importJwk, L as verifyCompactJsonLd, M as hasSignature, Mt as isPortableUri, N as hasSignatureLike, Nt as isSameObjectId, O as compactJsonLd, Ot as hasPortableActor, P as isClearlyMalformedContextReference, Q as getDurationMs, S as verifyPreparedPortableObjectProofPolicy, St as verificationObservation, T as InvalidContextReferenceError, Tt as getGatewayKeyBase, V as exportJwk, Y as MAX_PORTABLE_KEY_TTL, _ as verifyMapLocalProof, at as recordCollectionPageItems, b as verifyPortableObjectProofPolicy, bt as observeAttempt, c as verifyRequestDetailed, d as InvalidPortableObjectIdError, dt as recordOutboxActivity, et as getRemoteHost, f as classifyFep2277CoreType, ft as recordOutboxEnqueue, g as signObject, gt as formatAcceptSignature, h as preparePortableObjectProofPolicy, ht as preloadedOnlyDocumentLoader, i as selectRequestSignature, it as recordCollectionDispatchDuration, j as getNormalizationContextLoader, jt as isPortableKeyId, kt as isCompatibleKeyId, lt as recordFanoutRecipients, m as hasProofLike, mt as registerQueueDepthGauge, n as listRequestSignatures, nt as isAbortError, o as validateMaxSignatures, ot as recordCollectionRequest, pt as recordWebFingerHandle, q as validateCryptoKey, r as parseRfc9421SignatureInput, rt as recordCircuitBreakerStateChange, s as verifyRequest, st as recordCollectionTotalItems, t as doubleKnock, tt as instrumentDocumentLoader, ut as recordInboxActivity, v as verifyObject, w as normalizeOutgoingActivityJsonLd, wt as getCanonicalPortableId, x as verifyPortableObjectProofWithRoot, xt as snapshotKey, y as verifyPortableObjectProof } from "./http-DlNxxW_5.js";
-import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CC2zNAje.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-7015lbrx.js";
+import { $ as getVerifiedKeyOwnerEvidence, A as compactJsonLd, At as getRawCanonicalPortableId, B as verifyCompactJsonLdDetailed, C as verifyPortableObjectProofWithRoot, Ct as observeAttempt, D as InvalidContextReferenceError, Dt as getCanonicalPortableId, E as normalizeOutgoingActivityJsonLd, Et as getAuthenticationOrigin, F as hasSignatureLike, Ft as isPortableUri, I as isClearlyMalformedContextReference, It as isSameObjectId, L as isInvalidUrlTypeError, M as detachSignature, Mt as isCompatibleKeyId, N as getNormalizationContextLoader, Nt as isPortableId, O as assertSafeJsonLd, Ot as getGatewayKeyBase, P as hasSignature, Pt as isPortableKeyId, Q as MAX_PORTABLE_KEY_TTL, R as markEffectiveContextLoader, Rt as name, S as verifyPortableObjectProofPolicy, Tt as verificationObservation, U as wrapContextLoaderForJsonLd, W as exportJwk, X as validateCryptoKey, Y as importJwk, _ as signObject, _t as registerQueueDepthGauge, at as isAbortError, b as verifyObjectDetailed, c as verifyRequestDetailed, ct as recordCollectionPageItems, d as InvalidPortableObjectIdError, f as classifyFep2277CoreType, ft as recordFanoutRecipients, g as preparePortableObjectProofPolicy, gt as recordWebFingerHandle, h as hasProofLike, ht as recordOutboxEnqueue, i as selectRequestSignature, it as instrumentDocumentLoader, jt as hasPortableActor, kt as getPortableDid, lt as recordCollectionRequest, m as getProofSigner, mt as recordOutboxActivity, n as listRequestSignatures, nt as getFederationMetrics, o as validateMaxSignatures, ot as recordCircuitBreakerStateChange, pt as recordInboxActivity, r as parseRfc9421SignatureInput, rt as getRemoteHost, s as verifyRequest, st as recordCollectionDispatchDuration, t as doubleKnockScoped, tt as getDurationMs, ut as recordCollectionTotalItems, v as verifyMapLocalProof, vt as preloadedOnlyDocumentLoader, w as verifyPreparedPortableObjectProofPolicy, wt as snapshotKey, x as verifyPortableObjectProof, y as verifyObject, yt as formatAcceptSignature, z as signJsonLd, zt as version } from "./http-ChXUU_3c.js";
+import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-DUjZb4i6.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-TmtpzD4E.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DQcte7ES.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
-import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
+import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, lookupObserver, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
-import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, preloadedContexts, resolveDocumentLoaderTimeout, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, preloadedContexts, resolveDocumentLoaderTimeout, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { uniq } from "es-toolkit";
+import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { parse, stringifyAsync } from "devalue";
@@ -32,9 +34,12 @@ var ActivityListenerSet = class {
 		clone.#listeners = new Map(this.#listeners);
 		return clone;
 	}
-	add(type, listener) {
+	add(type, listener, options = {}) {
 		if (this.#listeners.has(type)) throw new TypeError("Listener already set for this type.");
-		this.#listeners.set(type, listener);
+		this.#listeners.set(type, {
+			listener,
+			options: { ...options }
+		});
 	}
 	dispatchWithClass(activity) {
 		let cls = activity.constructor;
@@ -44,10 +49,11 @@ var ActivityListenerSet = class {
 			cls = globalThis.Object.getPrototypeOf(cls);
 		}
 		if (cls == null) return null;
-		const listener = this.#listeners.get(cls);
+		const { listener, options } = this.#listeners.get(cls);
 		return {
 			class: cls,
-			listener
+			listener,
+			options
 		};
 	}
 	dispatch(activity) {
@@ -635,8 +641,8 @@ var FederationBuilderImpl = class {
 		}
 		const listeners = this.inboxListeners = new ActivityListenerSet();
 		const setters = {
-			on(type, listener) {
-				listeners.add(type, listener);
+			on(type, listener, options) {
+				listeners.add(type, listener, options);
 				return setters;
 			},
 			onError: (handler) => {
@@ -2804,6 +2810,172 @@ async function isInAudience(object, actor, options = {}) {
 	return false;
 }
 //#endregion
+//#region src/federation/inbox-authentication.ts
+/**
+* The evidence of an activity that has not been authenticated by Fedify.
+*/
+const EMPTY_EVIDENCE = Object.freeze({
+	verified: false,
+	requestSigners: Object.freeze([]),
+	documentSigners: Object.freeze([]),
+	originAuthenticated: Object.freeze([]),
+	expandedActivity: Object.freeze([]),
+	baseUrl: null
+});
+/**
+* Gets the evidence of an activity that has not been authenticated.
+* @internal
+*/
+function getEmptyAuthenticationEvidence() {
+	return EMPTY_EVIDENCE;
+}
+/**
+* Gets the principals that an authorization decision should rely on.
+* @param evidence The evidence.
+* @param scope See {@link IsActorAuthenticatedOptions.scope}.
+* @returns The principals.
+* @internal
+*/
+function getEffectivePrincipals(evidence, scope = "effective") {
+	if (scope === "document" || evidence.documentSigners.length > 0) return evidence.documentSigners;
+	if (evidence.requestSigners.length > 0) return evidence.requestSigners;
+	return evidence.originAuthenticated;
+}
+/**
+* Normalizes an actor ID for comparison: portable IDs and compatible
+* identifiers to their canonical portable ID, other IDs to their `href`.
+* @returns The normalized ID, or `null` for a malformed portable ID.
+*/
+function normalizeActorId(id) {
+	return isPortableId(id) ? getCanonicalPortableId(id) : id.href;
+}
+/**
+* Checks whether the given principal authenticates the given actor.
+* @param principal The principal.
+* @param actorId The actor ID.
+* @returns `true` if the principal authenticates the actor.
+* @internal
+*/
+function principalAuthenticates(principal, actorId) {
+	if (principal.kind === "portableAuthority") {
+		if (!isPortableId(actorId)) return false;
+		const did = getPortableDid(actorId);
+		return did != null && did === getPortableDid(principal.id);
+	}
+	const expected = normalizeActorId(actorId);
+	return expected != null && normalizeActorId(principal.id) === expected;
+}
+/**
+* Checks whether the given evidence authenticates the given actor.
+*
+* Actor IDs are compared exactly, except that [FEP-ef61] portable IDs and
+* compatible identifiers are compared by their canonical portable IDs, and
+* a portable authority (a DID) authenticates the portable actors of that DID.
+*
+* @example
+* ``` typescript
+* federation
+*   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+*   .on(Follow, async (ctx, follow) => {
+*     if (follow.actorId == null) return;
+*     // The actor is always authenticated for activities that declare one,
+*     // but the same check works for any actor an activity names:
+*     isActorAuthenticated(ctx.authentication, follow.actorId);
+*   });
+* ```
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param evidence The authentication evidence, usually
+*                 {@link InboxContext.authentication}.
+* @param actorId The actor ID to check.
+* @param options Options.
+* @returns `true` if the actor is authenticated.
+* @since 2.5.0
+*/
+function isActorAuthenticated(evidence, actorId, options = {}) {
+	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
+}
+function serializePrincipal(principal) {
+	return {
+		kind: principal.kind,
+		id: principal.id.href,
+		mechanism: principal.mechanism,
+		keyId: principal.keyId?.href ?? null
+	};
+}
+/**
+* Serializes the principals of the given evidence for a queued message.
+* @internal
+*/
+function serializeAuthentication(evidence) {
+	return {
+		verified: evidence.verified,
+		requestSigners: evidence.requestSigners.map(serializePrincipal),
+		documentSigners: evidence.documentSigners.map(serializePrincipal),
+		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
+	};
+}
+const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
+const MECHANISMS = /* @__PURE__ */ new Set([
+	"httpSignatures",
+	"linkedDataSignatures",
+	"objectIntegrityProofs",
+	"origin"
+]);
+function deserializePrincipals(value) {
+	if (!Array.isArray(value)) return null;
+	const principals = [];
+	for (const item of value) {
+		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		principals.push(Object.freeze({
+			kind: item.kind,
+			id: new URL(item.id),
+			mechanism: item.mechanism,
+			keyId: item.keyId == null ? null : new URL(item.keyId)
+		}));
+	}
+	return principals;
+}
+/**
+* Restores the evidence of a queued message.
+* @param value The serialized principals.
+* @param expandedActivity The expanded activity, restored from the queued
+*                         verified view.
+* @param baseUrl The base URL, restored from the queued verified view.
+* @returns The evidence, or `null` if the serialized value is malformed.
+* @internal
+*/
+function deserializeAuthentication(value, expandedActivity, baseUrl) {
+	if (value == null || typeof value !== "object" || typeof value.verified !== "boolean") return null;
+	const record = value;
+	const requestSigners = deserializePrincipals(record.requestSigners);
+	const documentSigners = deserializePrincipals(record.documentSigners);
+	const originAuthenticated = deserializePrincipals(record.originAuthenticated);
+	if (requestSigners == null || documentSigners == null || originAuthenticated == null) return null;
+	return createAuthenticationEvidence({
+		verified: record.verified,
+		requestSigners,
+		documentSigners,
+		originAuthenticated,
+		expandedActivity,
+		baseUrl
+	});
+}
+/**
+* Creates frozen evidence.
+* @internal
+*/
+function createAuthenticationEvidence(evidence) {
+	return Object.freeze({
+		verified: evidence.verified,
+		requestSigners: Object.freeze([...evidence.requestSigners]),
+		documentSigners: Object.freeze([...evidence.documentSigners]),
+		originAuthenticated: Object.freeze([...evidence.originAuthenticated]),
+		expandedActivity: evidence.expandedActivity,
+		baseUrl: evidence.baseUrl
+	});
+}
+//#endregion
 //#region src/federation/inbox.ts
 /**
 * Checks whether an activity's ID and all of its actor IDs have the same
@@ -2825,13 +2997,135 @@ function actorsHaveSameOrigin(activity) {
 	const origin = getAuthenticationOrigin(activity.id);
 	return origin != null && activity.actorIds.every((actor) => getAuthenticationOrigin(actor) === origin);
 }
-async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
+/**
+* The headroom that the size check of a queued inbox message leaves for the
+* fields that grow when Fedify retries the message, e.g., its attempt count.
+*/
+const QUEUED_MESSAGE_HEADROOM = 64;
+/**
+* Computes the idempotency key of an incoming activity.
+* @returns The key, or `null` if the activity is not deduplicated.
+* @internal
+*/
+async function getInboxIdempotencyKey(strategy, inboxContext, activity, origin, recipient, prefix) {
+	if (activity.id == null) return null;
+	strategy ??= "per-inbox";
+	let keyString;
+	if (typeof strategy === "function") keyString = await strategy(inboxContext(), activity);
+	else switch (strategy) {
+		case "global":
+			keyString = activity.id.href;
+			break;
+		case "per-origin":
+			keyString = `${origin}\n${activity.id.href}`;
+			break;
+		case "per-inbox":
+			keyString = `${origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
+			break;
+		default: keyString = `${origin}\n${activity.id.href}`;
+	}
+	return keyString == null ? null : [...prefix, keyString];
+}
+/**
+* Checks whether an incoming activity has already been processed, by its
+* idempotency key, or by the key that queue workers of older versions of
+* Fedify recorded.
+* @internal
+*/
+async function isInboxActivityProcessed(kv, cacheKey, activity, origin, prefix) {
+	if (cacheKey == null) return false;
+	if (await kv.get(cacheKey) === true) return true;
+	if (activity.id == null) return false;
+	return await kv.get([
+		...prefix,
+		origin,
+		activity.id.href
+	]) === true;
+}
+/**
+* The bytes added to the UTF-8 JSON length of a message for each of its JSON
+* values, to bound the size of serialization formats other than JSON, such
+* as the structured serialization of Deno KV, which spends more bytes than
+* JSON on type tags and lengths of small values, e.g., empty arrays, and up
+* to nine bytes on a fractional number that JSON writes in three.
+*/
+const PER_VALUE_SERIALIZATION_OVERHEAD = 8;
+/**
+* Estimates, conservatively, how large a queued message is once a queue
+* backend serializes it: the UTF-8 length of its JSON serialization, plus
+* a fixed overhead for each JSON value in it, plus the bytes that encoding
+* strings beyond Latin-1 as UTF-16 adds.
+* @internal
+*/
+function estimateQueuedMessageSize(message) {
+	const encoder = new TextEncoder();
+	let values = 0;
+	let stringExpansion = 0;
+	const countString = (value) => {
+		values++;
+		if (!/[\u0100-\uffff]/.test(value)) return;
+		const expansion = value.length * 2 - encoder.encode(value).byteLength;
+		if (expansion > 0) stringExpansion += expansion;
+	};
+	const count = (value) => {
+		if (typeof value === "string") {
+			countString(value);
+			return;
+		}
+		values++;
+		if (Array.isArray(value)) for (const item of value) count(item);
+		else if (value != null && typeof value === "object") for (const [key, item] of Object.entries(value)) {
+			if (item === void 0) continue;
+			countString(key);
+			count(item);
+		}
+	};
+	count(message);
+	return encoder.encode(JSON.stringify(message)).byteLength + stringExpansion + values * PER_VALUE_SERIALIZATION_OVERHEAD;
+}
+/**
+* Checks whether an activity that declares no actor is authenticated: at
+* least one principal must be authenticated for it, and its ID, if any, must
+* have the same [FEP-fe34] origin as one of those principals.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @returns `"ok"` if it is authenticated, or why it is not.
+* @internal
+*/
+function checkActorlessActivity(activity, authentication) {
+	const principals = getEffectivePrincipals(authentication);
+	if (principals.length < 1) return {
+		status: "noAuthenticatedPrincipal",
+		principals
+	};
+	if (activity.id == null) return {
+		status: "ok",
+		principals
+	};
+	const origin = getAuthenticationOrigin(activity.id);
+	if (origin == null || !principals.some((principal) => getAuthenticationOrigin(principal.id) === origin)) return {
+		status: "activityOriginMismatch",
+		principals
+	};
+	return {
+		status: "ok",
+		principals
+	};
+}
+/**
+* Same as {@link checkActorlessActivity}, but returns a boolean.
+* @internal
+*/
+function isActorlessActivityAuthenticated(activity, authentication) {
+	return checkActorlessActivity(activity, authentication).status === "ok";
+}
+async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, authentication, verifiedView, replayable, actorless, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
-	if (activity.actorId == null) {
+	if (activity.actorId == null && !actorless) {
 		logger.error("Missing actor.", { activity: json });
 		span.setStatus({
 			code: SpanStatusCode.ERROR,
@@ -2840,58 +3134,59 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
 		return "missingActor";
 	}
-	let cacheKey = null;
-	if (activity.id != null) {
-		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
-		const strategy = idempotencyStrategy ?? "per-inbox";
-		let keyString;
-		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
-		else switch (strategy) {
-			case "global":
-				keyString = activity.id.href;
-				break;
-			case "per-origin":
-				keyString = `${ctx.origin}\n${activity.id.href}`;
-				break;
-			case "per-inbox":
-				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
-				break;
-			default: keyString = `${ctx.origin}\n${activity.id.href}`;
-		}
-		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
+	const contextMetadata = { authentication };
+	const cacheKey = await getInboxIdempotencyKey(idempotencyStrategy, () => inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href, contextMetadata), activity, ctx.origin, recipient, kvPrefixes.activityIdempotence);
+	if (await isInboxActivityProcessed(kv, cacheKey, activity, ctx.origin, kvPrefixes.activityIdempotence)) {
+		logger.debug("Activity {activityId} has already been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: SpanStatusCode.UNSET,
+			message: `Activity ${activity.id?.href} has already been processed.`
+		});
+		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+		return "alreadyProcessed";
 	}
-	if (cacheKey != null) {
-		if (await kv.get(cacheKey) === true) {
-			logger.debug("Activity {activityId} has already been processed.", {
+	if (activity.actorId != null) span.setAttribute("activitypub.actor.id", activity.actorId.href);
+	let message;
+	if (queue != null) {
+		const carrier = {};
+		propagation.inject(context.active(), carrier);
+		message = {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: ctx.origin,
+			activity: originalJson ?? json,
+			...normalizedActivity == null ? {} : { normalizedActivity },
+			...ldSignatureVerified == null ? {} : { ldSignatureVerified },
+			...verifiedView == null ? {} : { verifiedView },
+			...authentication == null ? {} : { authentication: serializeAuthentication(authentication) },
+			identifier: recipient,
+			attempt: 0,
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			traceContext: carrier
+		};
+		const maxMessageSize = queue.maxMessageSize;
+		if (replayable === false) {
+			logger.warn("The incoming activity {activityId} uses a JSON-LD context that cannot be kept for the queue; processing it immediately instead.", {
 				activityId: activity.id?.href,
-				activity: json,
 				recipient
 			});
-			span.setStatus({
-				code: SpanStatusCode.UNSET,
-				message: `Activity ${activity.id?.href} has already been processed.`
+			message = void 0;
+		} else if (maxMessageSize != null && estimateQueuedMessageSize(message) > maxMessageSize - QUEUED_MESSAGE_HEADROOM) {
+			logger.warn("The incoming activity {activityId} is too large to enqueue; processing it immediately instead.", {
+				activityId: activity.id?.href,
+				recipient,
+				maxMessageSize
 			});
-			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
-			return "alreadyProcessed";
+			message = void 0;
 		}
 	}
-	span.setAttribute("activitypub.actor.id", activity.actorId.href);
-	if (queue != null) {
-		const carrier = {};
-		propagation.inject(context.active(), carrier);
+	if (queue != null && message != null) {
 		try {
-			await queue.enqueue({
-				type: "inbox",
-				id: crypto.randomUUID(),
-				baseUrl: ctx.origin,
-				activity: originalJson ?? json,
-				...normalizedActivity == null ? {} : { normalizedActivity },
-				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
-				identifier: recipient,
-				attempt: 0,
-				started: (/* @__PURE__ */ new Date()).toISOString(),
-				traceContext: carrier
-			});
+			await queue.enqueue(message);
 		} catch (error) {
 			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
 				error,
@@ -2941,7 +3236,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			const started = performance.now();
 			try {
 				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
-				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType), activity);
+				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType, contextMetadata), activity);
 			} finally {
 				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
 			}
@@ -2982,6 +3277,382 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
+//#region src/federation/inbox-view.ts
+/**
+* The interpretation of an incoming activity that Fedify authenticated, kept
+* so that listeners, authorization helpers, and queue workers observe the
+* same JSON-LD meaning that signature verification observed.
+*
+* Every JSON-LD processing step of one delivery goes through a request-scoped
+* *context snapshot*, which memoizes the remote context responses so that
+* a nondeterministic or mutable remote context cannot give verification and
+* dispatch different meanings.  The snapshot is serialized into queued
+* messages, so that workers and retries replay the very same responses
+* without loading contexts again.
+* @module
+*/
+/**
+* Thrown when replaying an interpretation needs a context response that its
+* snapshot does not have, or has with a different content.
+* @internal
+*/
+var ContextSnapshotMissError = class extends Error {
+	url;
+	constructor(url, reason) {
+		super(`Context ${url} cannot be replayed: ${reason}.`);
+		this.name = "ContextSnapshotMissError";
+		this.url = url;
+	}
+};
+function normalizeUrl(url) {
+	return URL.canParse(url) ? new URL(url).href : url;
+}
+/**
+* Creates the context snapshot of a delivery.
+* @param base The caller's context loader.
+* @returns The snapshot.
+* @internal
+*/
+function createContextSnapshot(base) {
+	const underlying = {
+		standard: wrapContextLoaderForJsonLd(base),
+		normalization: getNormalizationContextLoader(base)
+	};
+	const cache = /* @__PURE__ */ new Map();
+	const recorded = /* @__PURE__ */ new Map();
+	const loaders = /* @__PURE__ */ new Map();
+	let released = false;
+	return {
+		loader(policy) {
+			let loader = loaders.get(policy);
+			if (loader != null) return loader;
+			const effective = underlying[policy];
+			loader = markEffectiveContextLoader(async (url, options) => {
+				if (released) return await effective(url, options);
+				const normalizedUrl = normalizeUrl(url);
+				const key = `${policy}\n${normalizedUrl}`;
+				let promise = cache.get(key);
+				if (promise == null) {
+					promise = Promise.resolve(effective(url, options)).then((response) => {
+						const cloned = normalizeResponse(structuredClone(response));
+						recorded.set(key, {
+							policy,
+							url: normalizedUrl,
+							response: structuredClone(cloned)
+						});
+						return cloned;
+					});
+					promise.catch(() => {});
+					cache.set(key, promise);
+				}
+				return structuredClone(await promise);
+			}, policy);
+			loaders.set(policy, loader);
+			return loader;
+		},
+		entries() {
+			return [...recorded.values()];
+		},
+		release() {
+			released = true;
+		}
+	};
+}
+function getBundledResponse(url) {
+	if (!(url in preloadedContexts)) return null;
+	return {
+		contextUrl: null,
+		document: preloadedContexts[url],
+		documentUrl: url
+	};
+}
+async function sha256(value) {
+	return encodeHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(serialize(value))));
+}
+function normalizeResponse(response) {
+	return {
+		contextUrl: response.contextUrl ?? null,
+		document: response.document,
+		documentUrl: response.documentUrl
+	};
+}
+/**
+* Serializes the entries of a context snapshot for a queued message.
+* @param entries The entries.
+* @returns The serialized entries, which are plain JSON values.
+* @internal
+*/
+async function serializeContextSnapshot(entries) {
+	const result = [];
+	for (const entry of entries) {
+		const response = normalizeResponse(entry.response);
+		const hash = await sha256(response);
+		const bundled = getBundledResponse(entry.url);
+		if (bundled != null && await sha256(bundled) === hash) result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			bundled: true
+		});
+		else result.push({
+			policy: entry.policy,
+			url: entry.url,
+			sha256: hash,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+function isRemoteDocument(value) {
+	if (value == null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.documentUrl === "string" && "document" in record && (record.contextUrl == null || typeof record.contextUrl === "string");
+}
+/**
+* Restores the entries of a serialized context snapshot, verifying the
+* hashes of stored responses.  Bundled entries are reconstructed from the
+* contexts this version of Fedify bundles.
+* @param entries The serialized entries.
+* @returns The entries.
+* @throws {ContextSnapshotMissError} If an entry is malformed, or its
+*                                    content does not match its hash.
+* @internal
+*/
+async function deserializeContextSnapshot(entries) {
+	if (!Array.isArray(entries)) throw new ContextSnapshotMissError("(snapshot)", "malformed snapshot");
+	const result = [];
+	for (const entry of entries) {
+		if (entry == null || typeof entry !== "object" || entry.policy !== "standard" && entry.policy !== "normalization" || typeof entry.url !== "string" || typeof entry.sha256 !== "string") throw new ContextSnapshotMissError("(snapshot)", "malformed entry");
+		let response;
+		if (entry.bundled === true) {
+			response = getBundledResponse(entry.url);
+			if (response == null) throw new ContextSnapshotMissError(entry.url, "not bundled");
+		} else if (isRemoteDocument(entry.response)) response = normalizeResponse(entry.response);
+		else throw new ContextSnapshotMissError(entry.url, "malformed entry");
+		if (entry.bundled !== true && await sha256(response) !== entry.sha256) throw new ContextSnapshotMissError(entry.url, "content mismatch");
+		result.push({
+			policy: entry.policy,
+			url: entry.url,
+			response: structuredClone(response)
+		});
+	}
+	return result;
+}
+/**
+* Creates a context loader of a policy that serves only the responses of
+* a snapshot.  It is marked as the effective loader of the policy.
+* @param entries The snapshot's entries.
+* @param policy The policy.
+* @returns The loader, which throws {@link ContextSnapshotMissError} for
+*          anything else.
+* @internal
+*/
+function createSnapshotOnlyLoader(entries, policy) {
+	const responses = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (entry.policy === policy) responses.set(entry.url, entry.response);
+	return markEffectiveContextLoader(async (url) => {
+		const response = responses.get(normalizeUrl(url));
+		if (response == null) throw new ContextSnapshotMissError(url, "not in the snapshot");
+		return structuredClone(response);
+	}, policy);
+}
+/**
+* Creates a {@link ReleasableLoader}.
+* @param strict The loader to use until release.
+* @param fallback The loader to use after release.
+* @param policy The policy both loaders apply.
+* @returns The releasable loader.
+* @internal
+*/
+function createReleasableLoader(strict, fallback, policy) {
+	let released = false;
+	return {
+		loader: markEffectiveContextLoader((url, options) => released ? fallback(url, options) : strict(url, options), policy),
+		release() {
+			released = true;
+		}
+	};
+}
+/**
+* Expands a JSON-LD document with the given context loader.
+* @param document The document.
+* @param contextLoader The context loader.
+* @returns The expanded document.
+* @internal
+*/
+async function expandDocument(document, contextLoader) {
+	return await jsonld.expand(document, { documentLoader: contextLoader });
+}
+/**
+* Computes the digest of an expanded document.
+* @param expanded The expanded document.
+* @returns The hex-encoded SHA-256 of its canonical JSON.
+* @internal
+*/
+function digestExpandedDocument(expanded) {
+	return sha256(expanded);
+}
+/**
+* Deeply freezes a JSON value.
+* @param value The value.
+* @returns The same value, frozen.
+* @internal
+*/
+function deepFreeze(value) {
+	if (value != null && typeof value === "object" && !Object.isFrozen(value)) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
+const ACTOR_IRI = "https://www.w3.org/ns/activitystreams#actor";
+/**
+* Gets the single root node of an expanded document.
+* @param expanded The expanded document.
+* @returns The root node, or `null` if there is not exactly one.
+* @internal
+*/
+function getRootNode(expanded) {
+	if (expanded.length !== 1) return null;
+	const node = expanded[0];
+	if (node == null || typeof node !== "object" || Array.isArray(node)) return null;
+	return node;
+}
+/**
+* Gets the values of a property of an expanded node, unwrapping a single
+* `@list` container the way generated vocabulary decoders do.
+* @param node The expanded node.
+* @param iri The property IRI.
+* @returns The values, or an empty array if the property is absent.
+* @internal
+*/
+function getPropertyValues(node, iri) {
+	const values = node[iri];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return [values];
+	if (values.length === 1 && values[0] != null && typeof values[0] === "object" && "@list" in values[0]) {
+		const list = values[0]["@list"];
+		return Array.isArray(list) ? list : [list];
+	}
+	return values;
+}
+/**
+* Tells whether the root node of an expanded activity declares any `actor`
+* value at all, including blank nodes, anonymous or untyped nodes, and
+* literals, which ID accessors and typed parsing may drop.
+* @param expanded The expanded activity.
+* @returns `"absent"` if the root node declares no actor; `"present"`
+*          otherwise, including when there is no single root node.
+* @internal
+*/
+function getActorPresence(expanded) {
+	const root = getRootNode(expanded);
+	if (root == null) return "present";
+	return getPropertyValues(root, ACTOR_IRI).length < 1 ? "absent" : "present";
+}
+/**
+* Builds the serialized view of an authenticated activity.  The document is
+* expanded through the snapshot, so that the snapshot holds every context
+* response the interpretation needs.
+* @param snapshot The delivery's context snapshot.
+* @param source Which document the activity was parsed from.
+* @returns The serialized view and the expanded activity.
+* @internal
+*/
+async function buildVerifiedActivityView(snapshot, source) {
+	const loader = snapshot.loader(source.policy);
+	const used = /* @__PURE__ */ new Set();
+	const expanded = await expandDocument(source.document, markEffectiveContextLoader((url, options) => {
+		used.add(normalizeUrl(url));
+		return loader(url, options);
+	}, source.policy));
+	const entries = snapshot.entries().filter((entry) => entry.policy === source.policy && used.has(entry.url));
+	const contexts = await serializeContextSnapshot(entries);
+	const references = /* @__PURE__ */ new Set();
+	collectContextReferences(source.document, source.baseUrl?.href, references);
+	for (const entry of entries) {
+		const { contextUrl, document } = entry.response;
+		collectContextReferences(document, entry.url, references);
+		if (contextUrl != null) collectContextReferences({ "@context": contextUrl }, entry.url, references);
+	}
+	return {
+		replayable: [...references].every((url) => used.has(url)),
+		view: {
+			version: 1,
+			policy: source.policy,
+			source: source.source,
+			baseUrl: source.baseUrl?.href ?? null,
+			contexts,
+			expandedDigest: await digestExpandedDocument(expanded)
+		},
+		expanded
+	};
+}
+/**
+* Collects the remote context references of a JSON-LD document or context
+* document: every IRI given as a value of `@context` at any depth, including
+* scoped contexts of term definitions, and of `@import`.
+* @param value The document.
+* @param base The URL to resolve relative references against.
+* @param references The set to add the normalized references to.
+*/
+function collectContextReferences(value, base, references) {
+	const add = (reference) => {
+		let url = reference;
+		if (base != null && URL.canParse(reference, base)) url = new URL(reference, base).href;
+		references.add(normalizeUrl(url));
+	};
+	const collectContext = (context) => {
+		if (typeof context === "string") add(context);
+		else if (Array.isArray(context)) for (const item of context) collectContext(item);
+		else if (context != null && typeof context === "object") {
+			const imported = context["@import"];
+			if (typeof imported === "string") add(imported);
+			walk(context);
+		}
+	};
+	const walk = (node) => {
+		if (Array.isArray(node)) for (const item of node) walk(item);
+		else if (node != null && typeof node === "object") for (const [key, item] of Object.entries(node)) if (key === "@context") collectContext(item);
+		else walk(item);
+	};
+	walk(value);
+}
+/**
+* Validates the shape of a serialized view taken from a queued message.
+* @param value The value of the message's `verifiedView` field.
+* @returns The view, or `null` if it is malformed or of an unsupported
+*          version.
+* @internal
+*/
+function parseSerializedVerifiedActivityView(value) {
+	if (value == null || typeof value !== "object") return null;
+	const view = value;
+	if (view.version !== 1 || view.policy !== "standard" && view.policy !== "normalization" || view.source !== "activity" && view.source !== "normalizedActivity" || view.baseUrl !== null && (typeof view.baseUrl !== "string" || !URL.canParse(view.baseUrl)) || !Array.isArray(view.contexts) || typeof view.expandedDigest !== "string") return null;
+	return view;
+}
+/**
+* Restores a view from a queued message without loading any context.
+* @param view The serialized view.
+* @param message The fields of the message the view refers to.
+* @returns The restored view.
+* @throws {ContextSnapshotMissError} If the view cannot be replayed exactly.
+* @internal
+*/
+async function restoreVerifiedActivityView(view, message) {
+	const loader = createSnapshotOnlyLoader(await deserializeContextSnapshot(view.contexts), view.policy);
+	if (view.source === "normalizedActivity" && message.normalizedActivity == null) throw new ContextSnapshotMissError("(normalizedActivity)", "the normalized activity is missing");
+	const document = detachSignature(view.source === "activity" ? message.activity : message.normalizedActivity);
+	const expanded = await expandDocument(document, loader);
+	if (await digestExpandedDocument(expanded) !== view.expandedDigest) throw new ContextSnapshotMissError("(activity)", "the interpretation does not match the authenticated one");
+	return {
+		document,
+		loader,
+		expanded,
+		baseUrl: view.baseUrl == null ? null : new URL(view.baseUrl)
+	};
+}
+//#endregion
 //#region src/federation/keycache.ts
 const KEY_CACHE_GENERATION = "3";
 const COMPATIBLE_KEY_SEGMENT = "__compatible";
@@ -3645,9 +4316,10 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 *
 * @param parameters The parameters for sending the activity.
 *                   See also {@link SendActivityParameters}.
+* @param deps The dependencies, for tests.
 * @throws {Error} If the activity fails to send.
 */
-function sendActivity(options) {
+function sendActivity(options, deps = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
 		kind: SpanKind.CLIENT,
@@ -3663,7 +4335,7 @@ function sendActivity(options) {
 			}, () => sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span));
+			}, span, deps));
 		} catch (e) {
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
@@ -3748,13 +4420,14 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
+		if (truncated) reader.cancel().catch(() => {});
 		reader.releaseLock();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -3763,9 +4436,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+	const openUnvalidatedHop = deps.openHop ?? (allowPrivateAddress ? openDirectFetch : (url) => openPublicFetch(url));
+	async function openHop(url) {
+		let session;
+		try {
+			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof UrlError && error.reason === "dns") {
 				logger.error("DNS resolution failed for URL: {url}", {
@@ -3782,82 +4457,90 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			});
 			throw error;
 		}
+		return session;
 	}
+	let initialSession;
 	try {
-		await validateUrl(inbox.href);
+		initialSession = await openHop(inbox.href);
 	} catch (error) {
 		if (error instanceof FetchError) federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
 		throw error;
 	}
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
-	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
-	});
-	let response;
+	let initialPending = true;
+	const openDeliveryHop = (url) => {
+		if (initialPending) {
+			initialPending = false;
+			return Promise.resolve(initialSession);
+		}
+		return openHop(url);
+	};
 	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
+		headers = new Headers(headers);
+		headers.set("Content-Type", "application/activity+json");
+		const request = new Request(inbox, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(activity),
+			redirect: "manual"
 		});
-	} catch (error) {
-		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+		let rsaKey = null;
+		for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+			rsaKey = key;
+			break;
+		}
+		if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
 			activityId,
+			inbox: inbox.href
+		});
+		else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			inbox: inbox.href,
-			error: failure
+			keys: keys.map((pair) => ({
+				keyId: pair.keyId.href,
+				privateKey: pair.privateKey
+			}))
 		});
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
-		throw failure;
-	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+		let outcome;
+		try {
+			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox)) : await doubleKnockScoped(request, rsaKey, {
+				tracerProvider,
+				specDeterminer
+			}, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox));
+		} catch (error) {
+			const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
+			logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 				activityId,
 				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
+				error: failure
 			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+			federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
+			throw failure;
+		}
+		try {
+			if (!outcome.ok) {
+				const { status, statusText, error, responseHeaders } = outcome;
+				logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+					activityId,
+					inbox: inbox.href,
+					status,
+					statusText,
+					error
+				});
+				throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+			}
+			deliverySuccess = true;
+			const eventAttributes = {
+				"activitypub.inbox.url": inbox.href,
+				"activitypub.activity.id": activityId ?? ""
+			};
+			if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+			const actorId = getActivityActorId(activity);
+			if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+			span.addEvent("activitypub.activity.sent", eventAttributes);
+		} finally {
+			federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
 	} finally {
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
+		if (initialPending) await initialSession.close();
 	}
 }
 function createFetchError(url, cause) {
@@ -3865,10 +4548,75 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"outbox"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Reads what is needed from the final response of a delivery while its
+* session is open: the body of a successful response is cancelled, and at
+* most 1 KiB of an error response body is read.
+*/
+async function consumeSendActivityResponse(response, inbox) {
+	if (response.ok) {
+		cancelResponseBody(response, response.url || inbox.href);
+		return { ok: true };
+	}
+	let error;
+	try {
+		error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+	} catch (_) {
+		error = "";
+	}
+	return {
+		ok: false,
+		status: response.status,
+		statusText: response.statusText,
+		error,
+		responseHeaders: new Headers(response.headers)
+	};
+}
+/**
+* Sends a request without signing it, following redirects manually like the
+* Fetch standard does.  Every hop is opened with `openHop()`, which validates
+* the destination, after the previous hop is closed.  The final response is
+* passed to `consume()`, and its session is closed after that.
+* This is exported only for tests; it is not exported from any entry point.
+* @param request The request to send.
+* @param openHop The function to open a session for each hop.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function fetchWithValidatedRedirects(request, openHop, consume) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
 	let body = await request.clone().text();
 	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
+		const session = await openHop(request.url);
+		let response;
+		try {
+			response = await session.fetch(request, { redirect: "manual" });
+		} catch (error) {
+			await closeAfterError(session, logger);
+			throw error;
+		}
 		const location = response.headers.get("Location");
 		if (![
 			301,
@@ -3876,11 +4624,21 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
+		].includes(response.status) || location == null) try {
+			return await consume(response);
+		} catch (error) {
+			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+				url: request.url,
+				error
+			});
+			throw error;
+		} finally {
+			await session.close();
+		}
+		cancelResponseBody(response, request.url);
+		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
 		const url = new URL(location, request.url);
-		await validateUrl(url.href);
 		const headers = new Headers(request.headers);
 		if (url.origin !== new URL(request.url).origin) {
 			headers.delete("Authorization");
@@ -3908,6 +4666,16 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 		});
 	}
 }
+async function closeAfterError(session, logger) {
+	try {
+		await session.close();
+	} catch (error) {
+		logger.debug("Failed to close the session for {url}: {error}", {
+			url: session.url.href,
+			error
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -4792,13 +5560,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -4844,7 +5612,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -4886,7 +5654,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -4902,7 +5670,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -5399,11 +6167,12 @@ async function handleInbox(request, options) {
 	}, async (span) => {
 		if (options.recipient != null) span.setAttribute("fedify.inbox.recipient", options.recipient);
 		const spanContext = span.spanContext();
+		const snapshot = createContextSnapshot(options.context.contextLoader);
 		try {
 			return await withContext({
 				traceId: spanContext.traceId,
 				spanId: spanContext.spanId
-			}, () => handleInboxInternal(request, options, span));
+			}, () => handleInboxInternal(request, options, span, snapshot));
 		} catch (e) {
 			options.observation.hasException = true;
 			span.setStatus({
@@ -5412,6 +6181,7 @@ async function handleInbox(request, options) {
 			});
 			throw e;
 		} finally {
+			snapshot.release();
 			options.observation.project(span);
 			span.end();
 		}
@@ -5423,9 +6193,10 @@ async function handleInbox(request, options) {
 * @param request The HTTP request.
 * @param options The parameters for handling the inbox.
 * @param span The OpenTelemetry span for tracing.
+* @param snapshot The context snapshot of the delivery.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleInboxInternal(request, parameters, span) {
+async function handleInboxInternal(request, parameters, span, snapshot) {
 	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const observation = parameters.observation;
 	const signatureObservation = { [verificationObservation]: observation.verification };
@@ -5539,6 +6310,8 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		keyTtl: publicKeyTtl
 	});
+	const standardLoader = snapshot.loader("standard");
+	const normalizationLoader = snapshot.loader("normalization");
 	const jsonWithoutSig = detachSignature(json);
 	const hasLdSignature = hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -5574,9 +6347,10 @@ async function handleInboxInternal(request, parameters, span) {
 	let compactedJson = json;
 	let compactedJsonWithoutSig = jsonWithoutSig;
 	let ldSigVerified = false;
+	let ldSigKey = null;
 	if (hasLdSignature) {
 		try {
-			compactedJson = await compactJsonLd(json, ctx.contextLoader);
+			compactedJson = await compactJsonLd(json, normalizationLoader);
 		} catch (error) {
 			if (isInvalidJsonLdError(error)) {
 				logger.error("Failed to parse JSON-LD:\n{error}", {
@@ -5612,16 +6386,18 @@ async function handleInboxInternal(request, parameters, span) {
 		if (compactedJson !== json) {
 			compactedJsonWithoutSig = detachSignature(compactedJson);
 			try {
-				ldSigVerified = await verifyCompactJsonLd(compactedJson, {
+				const ldResult = await verifyCompactJsonLdDetailed(compactedJson, {
 					...signatureObservation,
-					contextLoader: ctx.contextLoader,
+					contextLoader: normalizationLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
 					meterProvider,
 					tracerProvider
 				});
+				ldSigVerified = ldResult.verified;
+				ldSigKey = ldResult.key;
 			} catch (error) {
-				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+				if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 				if (isInvalidJsonLdError(error)) {
 					logger.error("Failed to parse JSON-LD:\n{error}", {
 						recipient,
@@ -5639,12 +6415,12 @@ async function handleInboxInternal(request, parameters, span) {
 				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 				if (!skipSignatureVerification) try {
 					await Object$1.fromJsonLd(compactedJson, {
-						contextLoader: getNormalizationContextLoader(ctx.contextLoader),
+						contextLoader: normalizationLoader,
 						documentLoader: ctx.documentLoader,
 						tracerProvider
 					});
 				} catch (parseError) {
-					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(parseError);
+					if (parseError instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(parseError);
 					if (isInvalidJsonLdError(parseError)) {
 						logger.error("Failed to parse JSON-LD:\n{error}", {
 							recipient,
@@ -5668,6 +6444,33 @@ async function handleInboxInternal(request, parameters, span) {
 	let activity = null;
 	let activityVerified = false;
 	let proofVerified = false;
+	let documentSigners = [];
+	let requestSigners = [];
+	let viewSource;
+	const rawViewSource = {
+		policy: "standard",
+		source: "activity",
+		document: jsonWithoutSig,
+		baseUrl: null
+	};
+	const isActorlessCandidate = async (candidate, source) => {
+		if (skipSignatureVerification) return false;
+		if (inboxListeners?.dispatchWithClass(candidate)?.options.allowActorless !== true) return false;
+		try {
+			return getActorPresence(await expandDocument(source.document, snapshot.loader(source.policy))) === "absent";
+		} catch {
+			return false;
+		}
+	};
+	const verifyProofs = (contextLoader = standardLoader) => verifyObjectDetailed(Activity, jsonWithoutSig, {
+		...signatureObservation,
+		contextLoader,
+		documentLoader: ctx.documentLoader,
+		keyCache,
+		meterProvider,
+		tracerProvider,
+		verifyPortableObject: ctx.verifyPortableObject
+	});
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -5676,18 +6479,49 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
-				contextLoader: getNormalizationContextLoader(ctx.contextLoader)
+				contextLoader: normalizationLoader
 			});
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, normalizationLoader)) return await respondInvalidActivity(error);
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		viewSource = {
+			policy: "normalization",
+			source: "normalizedActivity",
+			document: compactedJsonWithoutSig,
+			baseUrl: null
+		};
+		if (ldSigKey?.ownerId != null) documentSigners = [{
+			kind: "actor",
+			id: ldSigKey.ownerId,
+			mechanism: "linkedDataSignatures",
+			keyId: ldSigKey.id
+		}];
+		if (await isActorlessCandidate(activity, viewSource)) {
+			let result = null;
+			try {
+				result = await verifyProofs();
+			} catch (error) {
+				if (!isPermanentActivityParseError(error)) throw error;
+				logger.debug("Failed to verify the Object Integrity Proofs of the activity without an actor:\n{error}", {
+					recipient,
+					error
+				});
+			}
+			if (result?.status === "unavailable") throw result.error;
+			if (result?.status === "verified" && result.signers.length > 0) {
+				activity = observation.activity = result.object;
+				documentSigners = toProofPrincipals(result.signers);
+				viewSource = rawViewSource;
+				proofVerified = true;
+			}
+		}
 		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
 				...signatureObservation,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -5705,18 +6539,11 @@ async function handleInboxInternal(request, parameters, span) {
 			recipient,
 			json
 		});
+		let proofResult;
 		try {
-			activity = await verifyObject(Activity, jsonWithoutSig, {
-				...signatureObservation,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
-				documentLoader: ctx.documentLoader,
-				keyCache,
-				meterProvider,
-				tracerProvider,
-				verifyPortableObject: ctx.verifyPortableObject
-			});
+			proofResult = await verifyProofs();
 		} catch (error) {
-			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
+			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, standardLoader)) return await respondInvalidActivity(error);
 			if (deferredLdSignatureError != null) {
 				logger.debug("Object Integrity Proof fallback did not supersede a deferred Linked Data Signature failure:\n{error}", {
 					recipient,
@@ -5752,6 +6579,22 @@ async function handleInboxInternal(request, parameters, span) {
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
 			});
 		}
+		if (proofResult.status === "verified") if (proofResult.signers.length < 1 && await isActorlessCandidate(proofResult.object, rawViewSource)) activity = null;
+		else {
+			activity = proofResult.object;
+			documentSigners = toProofPrincipals(proofResult.signers);
+			viewSource = rawViewSource;
+		}
+		else if (proofResult.status === "unavailable") {
+			let parsed = null;
+			try {
+				parsed = await Activity.fromJsonLd(jsonWithoutSig, {
+					...ctx,
+					contextLoader: standardLoader
+				});
+			} catch {}
+			if (parsed != null && await isActorlessCandidate(parsed, rawViewSource)) throw proofResult.error;
+		}
 		if (activity == null) logger.debug("Object Integrity Proofs are not verified.", {
 			recipient,
 			activity: json
@@ -5881,14 +6724,28 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = observation.activity = await Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader)
+				contextLoader: standardLoader
 			});
 		} catch (error) {
 			if (!isPermanentActivityParseError(error)) throw error;
 			return await respondInvalidActivity(error);
 		}
+		viewSource = rawViewSource;
 	}
 	observation.activity = activity;
+	let view;
+	try {
+		view = await buildVerifiedActivityView(snapshot, viewSource ?? rawViewSource);
+	} catch (error) {
+		if (!isPermanentActivityParseError(error)) throw error;
+		return await respondInvalidActivity(error);
+	}
+	const actorless = !skipSignatureVerification && getActorPresence(view.expanded) === "absent" && inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true;
+	span.setAttribute("activitypub.activity.actorless", actorless);
+	if (actorless && httpSigKey != null) {
+		const principal = getHttpKeyPrincipal(httpSigKey);
+		if (principal != null) requestSigners = [principal];
+	}
 	observation.stage = "policy";
 	observation.result = {
 		disposition: "rejected",
@@ -5932,7 +6789,7 @@ async function handleInboxInternal(request, parameters, span) {
 		const rejection = await observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
 			const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
 				[verificationObservation]: verification,
-				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				contextLoader: standardLoader,
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -5970,7 +6827,7 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 	}
-	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !actorless && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		observation.authentication = {
 			status: "rejected",
@@ -5996,6 +6853,66 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (httpSigKey != null && !actorless && activity.actorId != null) requestSigners = [{
+		kind: "actor",
+		id: activity.actorId,
+		mechanism: "httpSignatures",
+		keyId: httpSigKey.id
+	}];
+	if (actorless) {
+		const check = checkActorlessActivity(activity, {
+			verified: true,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: [],
+			baseUrl: null
+		});
+		if (check.status === "noAuthenticatedPrincipal") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: { type: "noAuthenticatedPrincipal" }
+			};
+			logger.error("The activity {activityId} declares no actor, and no principal is authenticated for it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: "No principal is authenticated for the activity."
+			});
+			return new Response("No principal is authenticated for the activity.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		} else if (check.status === "activityOriginMismatch") {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: {
+					type: "activityOriginMismatch",
+					activityId: new URL(activity.id.href),
+					actorIds: check.principals.map((principal) => principal.id)
+				}
+			};
+			logger.error("The activity ({activityId}) does not have the same origin as the principals that authenticated it.", {
+				activity: json,
+				recipient,
+				activityId: activity.id?.href,
+				principals: check.principals.map((principal) => principal.id.href)
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `The activity (${activity.id?.href}) does not have the same origin as the principals that authenticated it.`
+			});
+			return new Response("The activity and its signers do not have the same origin.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (!skipSignatureVerification) {
 		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
 		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
@@ -6055,7 +6972,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
-	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+	if (!skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 		observation.authentication = {
 			status: "rejected",
 			reason: {
@@ -6084,7 +7001,7 @@ async function handleInboxInternal(request, parameters, span) {
 		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
 	};
 	observation.stage = "dispatch";
-	if (activity.actorId == null) {
+	if (!actorless && activity.actorId == null) {
 		observation.result = {
 			disposition: "rejected",
 			reason: "missingActor"
@@ -6108,6 +7025,17 @@ async function handleInboxInternal(request, parameters, span) {
 		originalJson: json,
 		normalizedActivity: hasLdSignature && compactedJson !== json ? compactedJson : void 0,
 		ldSignatureVerified: hasLdSignature ? ldSigVerified : void 0,
+		authentication: createAuthenticationEvidence({
+			verified: !skipSignatureVerification,
+			requestSigners,
+			documentSigners,
+			originAuthenticated: [],
+			expandedActivity: deepFreeze(view.expanded),
+			baseUrl: null
+		}),
+		verifiedView: view.view,
+		replayable: view.replayable,
+		actorless,
 		activity,
 		recipient,
 		inboxListeners,
@@ -6322,8 +7250,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -6832,6 +7760,42 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
+* Turns the signers of verified Object Integrity Proofs into principals.
+*/
+function toProofPrincipals(signers) {
+	return signers.map((signer) => ({
+		kind: signer.kind,
+		id: signer.id,
+		mechanism: "objectIntegrityProofs",
+		keyId: signer.keyId
+	}));
+}
+/**
+* Gets the principal of an HTTP Signature key, whose owner was confirmed by
+* the owner's own document, or by the signed document of a portable actor,
+* when the key was fetched.
+*/
+function getHttpKeyPrincipal(key) {
+	const evidence = getVerifiedKeyOwnerEvidence(key);
+	if (evidence != null) try {
+		return {
+			kind: "actor",
+			id: parseIri(evidence.ownerId),
+			mechanism: "httpSignatures",
+			keyId: key.id
+		};
+	} catch {
+		return null;
+	}
+	if (key.ownerId == null || isPortableId(key.ownerId)) return null;
+	return {
+		kind: "actor",
+		id: key.ownerId,
+		mechanism: "httpSignatures",
+		keyId: key.id
+	};
+}
+/**
 * Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
 * actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
 * URI, and it is owned by a portable actor, which only the portable actor's
@@ -9332,24 +10296,102 @@ var FederationImpl = class extends FederationBuilderImpl {
 			let dispatched;
 			let parseInput = void 0;
 			let parseContextLoader = context.contextLoader;
+			let authentication = getEmptyAuthenticationEvidence();
+			let actorPresence = "present";
+			if (message.verifiedView !== void 0) {
+				const view = parseSerializedVerifiedActivityView(message.verifiedView);
+				let restored;
+				let restoredAuthentication = null;
+				let failure;
+				if (view == null) failure = /* @__PURE__ */ new TypeError("The queued activity has a malformed verified view.");
+				else try {
+					if (view.source === "normalizedActivity") assertSafeJsonLd(message.normalizedActivity);
+					restored = await restoreVerifiedActivityView(view, message);
+				} catch (error) {
+					if (!(error instanceof ContextSnapshotMissError) && !isPermanentInboxParseError(error)) {
+						await handleRetriableFailure(error);
+						return;
+					}
+					failure = error;
+				}
+				if (restored != null) {
+					const expandedActivity = deepFreeze(restored.expanded);
+					restoredAuthentication = message.authentication === void 0 ? createAuthenticationEvidence({
+						...getEmptyAuthenticationEvidence(),
+						expandedActivity,
+						baseUrl: restored.baseUrl
+					}) : deserializeAuthentication(message.authentication, expandedActivity, restored.baseUrl);
+					if (restoredAuthentication == null) failure = /* @__PURE__ */ new TypeError("The queued activity has malformed authentication evidence.");
+				}
+				if (failure != null || restored == null || restoredAuthentication == null) {
+					await reportInboxError(failure);
+					logger.error("Failed to replay the queued incoming activity:\n{error}", {
+						error: failure,
+						trial: message.attempt,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					listenerSpan.setStatus({
+						code: SpanStatusCode.ERROR,
+						message: String(failure)
+					});
+					listenerSpan.end();
+					return;
+				}
+				authentication = restoredAuthentication;
+				actorPresence = getActorPresence(restored.expanded);
+				const policy = view.policy;
+				const replayLoader = createReleasableLoader(restored.loader, policy === "normalization" ? getNormalizationContextLoader(context.contextLoader) : wrapContextLoaderForJsonLd(context.contextLoader), policy);
+				parseInput = restored.document;
+				parseContextLoader = restored.loader;
+				try {
+					activity = await Activity.fromJsonLd(restored.document, {
+						...context,
+						contextLoader: replayLoader.loader,
+						...restored.baseUrl == null ? {} : { baseUrl: restored.baseUrl }
+					});
+				} catch (error) {
+					if (isPermanentInboxParseError(error)) {
+						await reportInboxError(error);
+						logger.error("Failed to parse the queued incoming activity:\n{error}", {
+							error,
+							trial: message.attempt,
+							activity: message.activity,
+							recipient: message.identifier
+						});
+						listenerSpan.setStatus({
+							code: SpanStatusCode.ERROR,
+							message: String(error)
+						});
+						listenerSpan.end();
+						return;
+					}
+					await handleRetriableFailure(error);
+					return;
+				} finally {
+					replayLoader.release();
+				}
+			}
 			try {
-				const hasSignatureField = hasSignature(message.activity);
-				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
-				const parseContext = hasSignatureField ? {
-					...context,
-					contextLoader: getNormalizationContextLoader(context.contextLoader)
-				} : {
-					...context,
-					contextLoader: wrapContextLoaderForJsonLd(context.contextLoader)
-				};
-				parseContextLoader = parseContext.contextLoader;
-				let normalizedActivity;
-				if (shouldParseFromNormalizedSignedPayload) {
-					normalizedActivity = message.normalizedActivity ?? await compactJsonLd(message.activity, context.contextLoader);
-					assertSafeJsonLd(normalizedActivity);
+				if (activity == null) {
+					const hasSignatureField = hasSignature(message.activity);
+					const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
+					const parseContext = hasSignatureField ? {
+						...context,
+						contextLoader: getNormalizationContextLoader(context.contextLoader)
+					} : {
+						...context,
+						contextLoader: wrapContextLoaderForJsonLd(context.contextLoader)
+					};
+					parseContextLoader = parseContext.contextLoader;
+					let normalizedActivity;
+					if (shouldParseFromNormalizedSignedPayload) {
+						normalizedActivity = message.normalizedActivity ?? await compactJsonLd(message.activity, context.contextLoader);
+						assertSafeJsonLd(normalizedActivity);
+					}
+					parseInput = shouldParseFromNormalizedSignedPayload ? detachSignature(normalizedActivity) : hasSignatureField ? detachSignature(message.activity) : message.activity;
+					activity = await Activity.fromJsonLd(parseInput, parseContext);
 				}
-				parseInput = shouldParseFromNormalizedSignedPayload ? detachSignature(normalizedActivity) : hasSignatureField ? detachSignature(message.activity) : message.activity;
-				activity = await Activity.fromJsonLd(parseInput, parseContext);
 				activityType = getTypeId(activity).href;
 				span.setAttribute("activitypub.activity.type", activityType);
 				listenerSpan.setAttribute("activitypub.activity.type", activityType);
@@ -9358,7 +10400,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 					span.setAttribute("activitypub.activity.id", activity.id.href);
 					listenerSpan.setAttribute("activitypub.activity.id", activity.id.href);
 				}
-				if (activity.actorId == null) {
+				const actorless = actorPresence === "absent" && !this.skipSignatureVerification && authentication.verified && this.inboxListeners?.dispatchWithClass(activity)?.options.allowActorless === true && isActorlessActivityAuthenticated(activity, authentication);
+				if (activity.actorId == null && !actorless) {
 					logger.error("Missing actor in queued incoming activity.", {
 						activityId: activity.id?.href,
 						activity: message.activity,
@@ -9372,7 +10415,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+				if (!this.skipSignatureVerification && !actorless && activity.id != null && !actorsHaveSameOrigin(activity)) {
 					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
 						activityId: activity.id.href,
 						actorIds: activity.actorIds.map((actor) => actor.href),
@@ -9387,22 +10430,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 					listenerSpan.end();
 					return;
 				}
-				cacheKey = activity.id == null ? null : [
-					...this.kvPrefixes.activityIdempotence,
-					context.origin,
-					activity.id.href
-				];
-				if (cacheKey != null) {
-					if (await this.kv.get(cacheKey) === true) {
-						logger.debug("Activity {activityId} has already been processed.", {
-							activityId: activity.id?.href,
-							activity: message.activity,
-							recipient: message.identifier
-						});
-						recordInboxActivity(this.meterProvider, "rejected", activityType);
-						listenerSpan.end();
-						return;
-					}
+				const parsedActivity = activity;
+				const parsedActivityType = activityType;
+				cacheKey = await getInboxIdempotencyKey(this.idempotencyStrategy, () => context.toInboxContext(message.identifier, message.activity, parsedActivity.id?.href, parsedActivityType, { authentication }), activity, context.origin, message.identifier, this.kvPrefixes.activityIdempotence);
+				if (await isInboxActivityProcessed(this.kv, cacheKey, activity, context.origin, this.kvPrefixes.activityIdempotence)) {
+					logger.debug("Activity {activityId} has already been processed.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					recordInboxActivity(this.meterProvider, "rejected", activityType);
+					listenerSpan.end();
+					return;
 				}
 				dispatched = this.inboxListeners?.dispatchWithClass(activity);
 			} catch (error) {
@@ -9461,7 +10500,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			try {
 				const started = performance.now();
 				try {
-					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType, { authentication }), activity);
 				} finally {
 					this.metrics.recordInboxProcessingDuration(activityType, getDurationMs(started));
 				}
@@ -9863,7 +10902,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		onNotAcceptable ??= notAcceptable;
 		onUnauthorized ??= unauthorized;
 		const url = new URL(request.url);
-		const route = this.router.route(url.pathname);
+		const route = this.router.route(url.pathname, { allowUnencodedColon: true });
 		if (route == null) {
 			const media = this.hashlinkMediaDispatcher == null ? null : parseHashlinkGatewayRequest(url);
 			if (media != null) return await this.#fetchHashlinkMedia(request, media, {
@@ -10768,7 +11807,7 @@ var ContextImpl = class ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
 		});
 	}
-	toInboxContext(recipient, activity, activityId, activityType) {
+	toInboxContext(recipient, activity, activityId, activityType, metadata) {
 		return new InboxContextImpl(recipient, activity, activityId, activityType, {
 			url: this.url,
 			federation: this.federation,
@@ -10776,7 +11815,7 @@ var ContextImpl = class ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, metadata?.authentication);
 	}
 	toOutboxContext(identifier, activity, activityId, activityType) {
 		return new OutboxContextImpl(identifier, activity, activityId, activityType, {
@@ -11391,12 +12430,20 @@ var ContextImpl = class ContextImpl {
 		});
 	}
 	async routeActivityInternal(recipient, activity, options = {}, span) {
+		const snapshot = createContextSnapshot(options.contextLoader ?? this.contextLoader);
+		try {
+			return await this.#routeActivityWithSnapshot(recipient, activity, options, span, snapshot);
+		} finally {
+			snapshot.release();
+		}
+	}
+	async #routeActivityWithSnapshot(recipient, activity, options, span, snapshot) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
 			"inbox"
 		]);
-		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const contextLoader = snapshot.loader("standard");
 		let json = await activity.toJsonLd({ contextLoader });
 		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
 			documentLoader: this.documentLoader,
@@ -11404,13 +12451,19 @@ var ContextImpl = class ContextImpl {
 			tracerProvider: this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
 		});
-		if (await verifyObject(Activity, json, {
+		let documentSigners = [];
+		let originAuthenticated = [];
+		let viewSource;
+		let fetchedView;
+		const document = detachSignature(json);
+		const verified = await verifyObjectDetailed(Activity, document, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			meterProvider: this.meterProvider,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyCache
-		}) == null) {
+		});
+		if (verified.status !== "verified") {
 			logger.debug("Object Integrity Proofs are not verified.", {
 				recipient,
 				activity: json
@@ -11422,8 +12475,29 @@ var ContextImpl = class ContextImpl {
 				});
 				return false;
 			}
-			const fetched = await this.lookupObject(activity.id, options);
-			if (fetched == null) {
+			let candidate;
+			let candidateView;
+			const verifications = /* @__PURE__ */ new WeakMap();
+			const fetched = await this.lookupObject(activity.id, {
+				...options,
+				contextLoader,
+				verifyPortableObject: async (document, verifierOptions) => {
+					const result = await this.verifyPortableObject(document, verifierOptions);
+					if (document != null && typeof document === "object") verifications.set(document, result);
+					return result;
+				},
+				[lookupObserver]: { accept: async (accepted) => {
+					candidate = accepted;
+					candidateView = await buildVerifiedActivityView(createContextSnapshot(accepted.contextLoader), {
+						policy: "standard",
+						source: "activity",
+						document: detachSignature(accepted.document),
+						baseUrl: accepted.baseUrl
+					});
+					return true;
+				} }
+			});
+			if (fetched == null || candidate == null || candidateView == null) {
 				logger.debug("Failed to fetch the remote activity object {activityId}.", {
 					recipient,
 					activity: json,
@@ -11459,11 +12533,50 @@ var ContextImpl = class ContextImpl {
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
-			json = await fetched.toJsonLd({ contextLoader });
-		} else logger.debug("Object Integrity Proofs are verified.", {
-			recipient,
-			activity: json
-		});
+			json = candidate.document;
+			fetchedView = candidateView;
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document: detachSignature(candidate.document),
+				baseUrl: candidate.baseUrl
+			};
+			if (isPortableId(fetched.id)) {
+				const result = verifications.get(candidate.document);
+				if (result?.verified === true && result.method === "proof") documentSigners = result.keys.flatMap((key) => {
+					const signer = getProofSigner(key);
+					return signer == null ? [] : [{
+						kind: signer.kind,
+						id: signer.id,
+						mechanism: "objectIntegrityProofs",
+						keyId: signer.keyId
+					}];
+				});
+			} else originAuthenticated = fetched.actorIds.map((actorId) => ({
+				kind: "actor",
+				id: actorId,
+				mechanism: "origin",
+				keyId: null
+			}));
+		} else {
+			logger.debug("Object Integrity Proofs are verified.", {
+				recipient,
+				activity: json
+			});
+			activity = verified.object;
+			documentSigners = verified.signers.map((signer) => ({
+				kind: signer.kind,
+				id: signer.id,
+				mechanism: "objectIntegrityProofs",
+				keyId: signer.keyId
+			}));
+			viewSource = {
+				policy: "standard",
+				source: "activity",
+				document,
+				baseUrl: null
+			};
+		}
 		if (activity.actorId == null) {
 			logger.debug("Activity is missing an actor; unable to verify.", {
 				recipient,
@@ -11478,10 +12591,21 @@ var ContextImpl = class ContextImpl {
 			});
 			return false;
 		}
+		const view = fetchedView ?? await buildVerifiedActivityView(snapshot, viewSource);
 		const routeResult = await routeActivity({
 			context: this,
 			json,
 			ldSignatureVerified: false,
+			authentication: createAuthenticationEvidence({
+				verified: true,
+				requestSigners: [],
+				documentSigners,
+				originAuthenticated,
+				expandedActivity: deepFreeze(view.expanded),
+				baseUrl: viewSource.baseUrl
+			}),
+			verifiedView: view.view,
+			replayable: view.replayable,
 			activity,
 			recipient,
 			inboxListeners: this.federation.inboxListeners,
@@ -11597,52 +12721,92 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		if (object instanceof Tombstone && !(object instanceof cls) && options?.tombstone !== "passthrough") return null;
 		return object;
 	}
-	#signedKey = void 0;
+	#signedKey = null;
+	#signedKeyOwner = null;
+	#signatureChecks = /* @__PURE__ */ new WeakMap();
+	#getSignatureCheck(documentLoader, contextLoader) {
+		let checks = this.#signatureChecks.get(documentLoader);
+		if (checks == null) {
+			checks = /* @__PURE__ */ new WeakMap();
+			this.#signatureChecks.set(documentLoader, checks);
+		}
+		let check = checks.get(contextLoader);
+		if (check == null) {
+			check = {};
+			checks.set(contextLoader, check);
+		}
+		return check;
+	}
 	async getSignedKey(options = {}) {
 		if (this.#signedKey != null) return this.#signedKey;
-		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
-			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader,
+		const documentLoader = options.documentLoader ?? this.documentLoader;
+		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const check = this.#getSignatureCheck(documentLoader, contextLoader);
+		if (check.key != null) return check.key;
+		const keyCache = documentLoader === this.documentLoader && contextLoader === this.contextLoader ? new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
+			documentLoader,
+			contextLoader,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
-		});
-		return this.#signedKey = await verifyRequest(this.request, {
+		}) : void 0;
+		const promise = verifyRequest(this.request, {
 			...this,
-			contextLoader: options.contextLoader ?? this.contextLoader,
-			documentLoader: options.documentLoader ?? this.documentLoader,
+			contextLoader,
+			documentLoader,
 			timeWindow: this.federation.signatureTimeWindow,
 			maxSignatures: this.federation.maxHttpSignatures,
+			keyCache,
 			meterProvider: this.meterProvider,
-			tracerProvider: options.tracerProvider ?? this.tracerProvider,
-			keyCache
+			tracerProvider: options.tracerProvider ?? this.tracerProvider
+		}).then((key) => {
+			if (key != null) this.#signedKey ??= key;
+			return key;
+		}).catch((error) => {
+			if (check.key === promise) check.key = void 0;
+			throw error;
 		});
+		check.key = promise;
+		return await promise;
 	}
-	#signedKeyOwner = void 0;
 	async getSignedKeyOwner(options = {}) {
 		if (this.#signedKeyOwner != null) return this.#signedKeyOwner;
-		const key = await this.getSignedKey(options);
-		if (key == null) return this.#signedKeyOwner = null;
-		try {
-			return this.#signedKeyOwner = await getKeyOwner(key, {
-				contextLoader: options.contextLoader ?? this.contextLoader,
-				documentLoader: options.documentLoader ?? this.documentLoader,
-				tracerProvider: options.tracerProvider ?? this.tracerProvider
-			});
-		} catch (error) {
-			if (error instanceof FetchError) {
-				getLogger([
-					"fedify",
-					"federation",
-					"actor"
-				]).warn("Failed to fetch the key owner {keyOwner} of {keyId} while verifying the request signature; treating the request as unauthenticated: {error}", {
-					keyId: key.id?.href,
-					keyOwner: error.url.href,
-					error
-				});
-				return this.#signedKeyOwner = null;
+		const normalizedOptions = {
+			documentLoader: options.documentLoader ?? this.documentLoader,
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			tracerProvider: options.tracerProvider ?? this.tracerProvider
+		};
+		const check = this.#getSignatureCheck(normalizedOptions.documentLoader, normalizedOptions.contextLoader);
+		if (check.owner != null) return check.owner;
+		const promise = this.getSignedKey(normalizedOptions).then(async (key) => {
+			if (key == null) {
+				if (check.owner === promise) check.owner = void 0;
+				return null;
+			}
+			try {
+				const owner = await getKeyOwner(key, normalizedOptions);
+				if (owner != null) this.#signedKeyOwner ??= owner;
+				return owner;
+			} catch (error) {
+				if (error instanceof FetchError) {
+					getLogger([
+						"fedify",
+						"federation",
+						"actor"
+					]).warn("Failed to fetch the key owner {keyOwner} of {keyId} while verifying the request signature; treating the request as unauthenticated: {error}", {
+						keyId: key.id?.href,
+						keyOwner: error.url.href,
+						error
+					});
+					return null;
+				}
+				throw error;
 			}
+		}).catch((error) => {
+			if (check.owner === promise) check.owner = void 0;
 			throw error;
-		}
+		});
+		check.owner = promise;
+		return await promise;
 	}
 	async isSignedByAudience(object, options = {}) {
 		return await isInAudience(object, null) || await isInAudience(object, await this.getSignedKeyOwner(options), options);
@@ -11832,12 +12996,14 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 	activity;
 	activityId;
 	activityType;
-	constructor(recipient, activity, activityId, activityType, options) {
+	authentication;
+	constructor(recipient, activity, activityId, activityType, options, authentication) {
 		super(options);
 		this.recipient = recipient;
 		this.activity = activity;
 		this.activityId = activityId;
 		this.activityType = activityType;
+		this.authentication = authentication ?? getEmptyAuthenticationEvidence();
 	}
 	clone(data) {
 		return new InboxContextImpl(this.recipient, this.activity, this.activityId, this.activityType, {
@@ -11847,7 +13013,7 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 			documentLoader: this.documentLoader,
 			contextLoader: this.contextLoader,
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher
-		});
+		}, this.authentication);
 	}
 	forwardActivity(forwarder, recipients, options) {
 		return forwardActivity(this, "inbox", forwarder, recipients, options).then(() => void 0);
@@ -11963,4 +13129,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { respondWithObjectIfAcceptable as a, digest as c, parseCircuitBreakerKvState as d, createFederationBuilder as f, respondWithObject as i, CircuitBreaker as l, handleWebFinger as n, SendActivityError as o, createExponentialBackoffPolicy as r, buildCollectionSynchronizationHeader as s, createFederation as t, normalizeCircuitBreakerOptions as u };
+export { respondWithObjectIfAcceptable as a, buildCollectionSynchronizationHeader as c, normalizeCircuitBreakerOptions as d, parseCircuitBreakerKvState as f, respondWithObject as i, digest as l, handleWebFinger as n, SendActivityError as o, createFederationBuilder as p, createExponentialBackoffPolicy as r, isActorAuthenticated as s, createFederation as t, CircuitBreaker as u };