@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { A as detachSignature, C as verifyProof, D as attachSignature, G as generateCryptoKeyPair, I as signJsonLd, K as importJwk, N as hasSignatureLike, R as verifyJsonLd, U as fetchKey, V as exportJwk, W as fetchKeyDetailed, _t as fulfillAcceptSignature, a as signRequest, c as verifyRequestDetailed, g as signObject, gt as formatAcceptSignature, k as createSignature, m as hasProofLike, p as createProof, s as verifyRequest, v as verifyObject, vt as parseAcceptSignature, y as verifyPortableObjectProof, yt as validateAcceptSignature, z as verifySignature } from "../http-DlNxxW_5.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-CC2zNAje.js";
+import { F as hasSignatureLike, H as verifySignature, J as generateCryptoKeyPair, K as fetchKey, M as detachSignature, St as validateAcceptSignature, T as verifyProof, V as verifyJsonLd, W as exportJwk, Y as importJwk, _ as signObject, a as signRequest, bt as fulfillAcceptSignature, c as verifyRequestDetailed, h as hasProofLike, j as createSignature, k as attachSignature, p as createProof, q as fetchKeyDetailed, s as verifyRequest, x as verifyPortableObjectProof, xt as parseAcceptSignature, y as verifyObject, yt as formatAcceptSignature, z as signJsonLd } from "../http-ChXUU_3c.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-TmtpzD4E.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-C5-FVX6t.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-Cony3_LC.mjs";
+import { t as verifyPortableObject } from "../portable-collection-CJeYTL61.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";
 import { test } from "@fedify/fixture";

package/dist/sig/portable-interop.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyPortableObjectProof, p as verifyProof } from "../proof-Cryb1c70.mjs";
-import { n as getKeyOwner } from "../owner-C5-FVX6t.mjs";
-import { t as verifyPortableObject } from "../portable-collection-Cony3_LC.mjs";
+import { d as verifyPortableObjectProof, h as verifyProof } from "../proof-GH7Poos_.mjs";
+import { n as getKeyOwner } from "../owner-DTnVpUKA.mjs";
+import { t as verifyPortableObject } from "../portable-collection-CJeYTL61.mjs";
 import { Application, DataIntegrityProof, lookupObject } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 //#region test-vectors/fep-ef61/tootik-v0.25.4/actor.json

package/dist/sig/portable-key.test.mjs

@@ -2,12 +2,12 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { S as fetchKeyDetailed, h as verifyJsonLd, p as signJsonLd, x as fetchKey } from "../ld-CD2CsPxq.mjs";
-import { p as verifyProof, r as createProof } from "../proof-Cryb1c70.mjs";
-import { n as resolvePortableActorKey } from "../portable-key-DNc_flH-.mjs";
-import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-BUJ5SFh6.mjs";
+import { C as fetchKey, _ as verifyJsonLd, m as signJsonLd, w as fetchKeyDetailed } from "../ld-CdvcOEXQ.mjs";
+import { h as verifyProof, r as createProof } from "../proof-GH7Poos_.mjs";
+import { n as resolvePortableActorKey } from "../portable-key-DcYok4ki.mjs";
+import { m as verifyRequestDetailed, p as verifyRequest, u as signRequest } from "../http-BoJCMnjY.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-C5-FVX6t.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { t as KvKeyCache } from "../keycache-N2opu4-3.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/proof.test.mjs

@@ -11,12 +11,12 @@ import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { a as verificationObservation } from "../verification-Dpfcw8ml.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { c as verifyObject, i as hasProofLike, l as verifyPortableObjectProof, o as signObject, p as verifyProof, r as createProof, s as verifyMapLocalProof } from "../proof-Cryb1c70.mjs";
-import { f as verifyRequest } from "../http-BUJ5SFh6.mjs";
+import { a as hasProofLike, c as verifyMapLocalProof, d as verifyPortableObjectProof, h as verifyProof, l as verifyObject, r as createProof, s as signObject, u as verifyObjectDetailed } from "../proof-GH7Poos_.mjs";
+import { p as verifyRequest } from "../http-BoJCMnjY.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-B-0nqOB1.mjs";
+import { n as getAuthenticatedDocumentLoader } from "../docloader-DCZkiTeF.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
-import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
+import { FetchError, decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -2530,7 +2530,7 @@ test("getAuthenticatedDocumentLoader() signs portable object requests to gateway
 			documentLoader: getAuthenticatedDocumentLoader({
 				keyId: new URL("https://example.com/key2"),
 				privateKey: rsaPrivateKey2
-			}),
+			}, { allowPrivateAddress: true }),
 			contextLoader: mockDocumentLoader,
 			gateways: ["https://example.com"],
 			verifyPortableObject: verifyPortableObjectProof
@@ -2594,5 +2594,45 @@ test("verifyObject() rejects a key whose controller redirects to another actor",
 		contextLoader: mockDocumentLoader
 	}), null);
 });
+test("verifyObjectDetailed() tells who signed the proofs", async () => {
+	const keyId = new URL("https://example.com/person2#key4");
+	const actor = new URL("https://example.com/person2");
+	const json = await (await signObject(new Create({
+		id: new URL("https://example.com/activities/detailed"),
+		actor,
+		object: new Note({ content: "Hello" })
+	}), ed25519PrivateKey, keyId, { contextLoader: mockDocumentLoader })).toJsonLd({ contextLoader: mockDocumentLoader });
+	const options = {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	};
+	const result = await verifyObjectDetailed(Create, json, options);
+	assertEquals(result.status, "verified");
+	assertEquals(result.status === "verified" ? result.signers.map((s) => [
+		s.kind,
+		s.id.href,
+		s.keyId.href
+	]) : [], [[
+		"actor",
+		actor.href,
+		keyId.href
+	]]);
+	const unsigned = await verifyObjectDetailed(Note, {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/notes/unsigned",
+		type: "Note"
+	}, options);
+	assertEquals(unsigned.status, "verified");
+	assertEquals(unsigned.status === "verified" ? unsigned.signers : null, []);
+	assertEquals((await verifyObjectDetailed(Create, json, {
+		...options,
+		documentLoader: (url) => url.startsWith("https://example.com/person2") ? Promise.reject(new FetchError(url, "Unavailable", new Response(null, { status: 503 }))) : mockDocumentLoader(url)
+	})).status, "unavailable");
+	assertEquals((await verifyObjectDetailed(Create, json, {
+		...options,
+		documentLoader: (url) => url.startsWith("https://example.com/person2") ? Promise.reject(new FetchError(url, "Gone", new Response(null, { status: 410 }))) : mockDocumentLoader(url)
+	})).status, "invalid");
+	assertEquals(await verifyObject(Create, json, options) != null, true);
+});
 //#endregion
 export {};

package/dist/sig/tootik-request-interop.test.mjs

@@ -5,10 +5,10 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyPortableObjectProof } from "../proof-Cryb1c70.mjs";
-import { p as verifyRequestDetailed } from "../http-BUJ5SFh6.mjs";
-import { o as createFederation } from "../middleware-CzoWvrdZ.mjs";
-import { t as doesActorOwnKey } from "../owner-C5-FVX6t.mjs";
+import { d as verifyPortableObjectProof } from "../proof-GH7Poos_.mjs";
+import { m as verifyRequestDetailed } from "../http-BoJCMnjY.mjs";
+import { o as createFederation } from "../middleware-CoBLrTKX.mjs";
+import { t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeHex } from "byte-encodings/hex";

package/dist/sig/tootik-send-interop.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyPortableObjectProof } from "../proof-Cryb1c70.mjs";
-import { p as verifyRequestDetailed } from "../http-BUJ5SFh6.mjs";
-import { t as doesActorOwnKey } from "../owner-C5-FVX6t.mjs";
+import { d as verifyPortableObjectProof } from "../proof-GH7Poos_.mjs";
+import { m as verifyRequestDetailed } from "../http-BoJCMnjY.mjs";
+import { t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { Create } from "@fedify/vocab";
 import { decodeMultibase, importDidKey } from "@fedify/vocab-runtime";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/verification.test.mjs

@@ -2,9 +2,9 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as verificationObservation } from "../verification-Dpfcw8ml.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-CD2CsPxq.mjs";
-import { c as verifyObject, o as signObject } from "../proof-Cryb1c70.mjs";
-import { l as signRequest, p as verifyRequestDetailed } from "../http-BUJ5SFh6.mjs";
+import { _ as verifyJsonLd, m as signJsonLd } from "../ld-CdvcOEXQ.mjs";
+import { l as verifyObject, s as signObject } from "../proof-GH7Poos_.mjs";
+import { m as verifyRequestDetailed, u as signRequest } from "../http-BoJCMnjY.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { Activity, Create, CryptographicKey, Multikey } from "@fedify/vocab";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/{temporal-BsAeuUJj.mjs → temporal-gJINzcL4.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-CD2CsPxq.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CdvcOEXQ.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-CzoWvrdZ.mjs";
+import { o as createFederation } from "../middleware-CoBLrTKX.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -5,7 +5,7 @@ import { Router } from "@fedify/uri-template";
 import { Activity, Actor, Collection, CryptographicKey, DataIntegrityProof, Hashtag, Link, LookupObjectOptions, Multikey, Note, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions, PortableObjectVerifier } from "@fedify/vocab-runtime";
+import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions, PortableObjectVerifier, RemoteDocument } from "@fedify/vocab-runtime";
 import { MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
@@ -416,6 +416,35 @@ interface GetKeyOwnerOptions {
   tracerProvider?: TracerProvider;
 }
 //#endregion
+//#region src/federation/activity-listener.d.ts
+/**
+ * Options for an inbox listener.
+ * @since 2.5.0
+ */
+interface InboxListenerOptions {
+  /**
+   * Whether activities that declare no `actor` at all may reach the listener.
+   *
+   * Some protocols identify the requester without an `actor`; for example,
+   * Mastodon sends [FEP-7aa9] `FeatureRequest` activities without one.  When
+   * this is `true`, such an activity is dispatched to the listener if Fedify
+   * authenticated at least one principal for it, i.e., the signer of its
+   * Object Integrity Proofs or Linked Data Signature, or otherwise the signer
+   * of the HTTP request, and its `id`, if any, has the same origin as that
+   * principal.  The listener is then responsible for authorizing the request
+   * with {@link InboxContext.authentication}, e.g., with
+   * `featureInteraction.verifyRequest()` from
+   * `@fedify/interaction-controls`.
+   *
+   * An activity that declares an `actor` is never affected by this option;
+   * its actor must be authenticated as usual.
+   *
+   * [FEP-7aa9]: https://w3id.org/fep/7aa9
+   * @default `false`
+   */
+  readonly allowActorless?: boolean;
+}
+//#endregion
 //#region src/federation/inbox-report.d.ts
 /**
  * A JSON value retained from the incoming request.
@@ -458,6 +487,13 @@ type InboxAuthentication = {
     readonly type: "activityOriginMismatch";
     readonly activityId: URL;
     readonly actorIds: readonly URL[];
+  } | {
+    /**
+     * The activity declares no actor, and no principal was authenticated
+     * for it, although its listener allows activities without an actor.
+     * @since 2.5.0
+     */
+    readonly type: "noAuthenticatedPrincipal";
   };
 } | {
   readonly status: "skipped";
@@ -1311,6 +1347,18 @@ interface MessageQueue {
    * @since 2.4.0
    */
   readonly atomicEnqueueMany?: boolean;
+  /**
+   * The largest message, in bytes, that the backend can hold.  Fedify compares
+   * it with a conservative estimate of a message's serialized size: the
+   * length of its JSON serialization encoded in UTF-8, plus 8 bytes for each
+   * JSON value in it, plus what encoding strings beyond Latin-1 as UTF-16
+   * adds, which also bounds binary serialization formats.  When an
+   * incoming activity would make a larger inbox message, Fedify processes the
+   * activity right away instead of enqueueing it, as if there were no inbox
+   * queue.  When omitted, messages are enqueued regardless of their size.
+   * @since 2.5.0
+   */
+  readonly maxMessageSize?: number;
   /**
    * Enqueues a message in the queue.
    * @param message The message to enqueue.
@@ -1349,6 +1397,176 @@ interface MessageQueue {
   getDepth?(): Promise<MessageQueueDepth>;
 }
 //#endregion
+//#region src/federation/inbox-authentication.d.ts
+/**
+ * A party that Fedify authenticated for an incoming activity, independently
+ * of the activity's declared `actor`.
+ * @since 2.5.0
+ */
+interface InboxPrincipal {
+  /**
+   * What {@link InboxPrincipal.id} is:
+   *
+   *  -  `"actor"`: an actor whose ownership of the verifying key Fedify
+   *     confirmed with the actor's own document.
+   *  -  `"portableAuthority"`: a DID whose verification method made a valid
+   *     Object Integrity Proof.  It authenticates the [FEP-ef61] portable
+   *     actors of that DID, and nothing else.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   */
+  readonly kind: "actor" | "portableAuthority";
+  /** The actor ID, or the DID if {@link kind} is `"portableAuthority"`. */
+  readonly id: URL;
+  /**
+   * How the principal was authenticated:
+   *
+   *  -  `"httpSignatures"`: it signed the HTTP request.
+   *  -  `"linkedDataSignatures"`: it made the Linked Data Signature of the
+   *     activity.
+   *  -  `"objectIntegrityProofs"`: it made an Object Integrity Proof of the
+   *     activity.
+   *  -  `"origin"`: the activity was fetched again from the actor's own web
+   *     origin, which happens only for `Context.routeActivity()`.
+   */
+  readonly mechanism: "httpSignatures" | "linkedDataSignatures" | "objectIntegrityProofs" | "origin";
+  /** The key or verification method that authenticated the principal. */
+  readonly keyId: URL | null;
+}
+/**
+ * Who Fedify authenticated for an incoming activity, and the interpretation of
+ * the activity it authenticated.  Inbox listeners receive it as
+ * {@link InboxContext.authentication}.
+ *
+ * Authenticated principals are independent of the activity's declared
+ * `actor`: an activity forwarded by a relay is signed by the relay in its
+ * HTTP request, but its document may be signed by its author, and some
+ * activities, such as [FEP-7aa9] `FeatureRequest`s sent by Mastodon, declare
+ * no `actor` at all.  A valid signature alone does not authorize anything;
+ * use {@link isActorAuthenticated} to check whether a specific actor was
+ * authenticated.
+ *
+ * [FEP-7aa9]: https://w3id.org/fep/7aa9
+ * @since 2.5.0
+ */
+interface InboxAuthenticationEvidence {
+  /**
+   * Whether signatures were verified at all.  It is `false` only when
+   * signature verification is skipped, or when there is no evidence, e.g.,
+   * for an activity queued by an older version of Fedify.  In that case all
+   * the principal lists are empty.
+   */
+  readonly verified: boolean;
+  /**
+   * The principals that signed the HTTP request, i.e., the server that
+   * delivered the activity, which may have forwarded it.  It is empty when
+   * the activity document was authenticated by its own signatures, so that
+   * HTTP Signatures did not need to be verified.
+   */
+  readonly requestSigners: readonly InboxPrincipal[];
+  /**
+   * The principals that made the verified Linked Data Signature or Object
+   * Integrity Proofs of the activity document.  All of them are listed when
+   * there are several proofs.
+   */
+  readonly documentSigners: readonly InboxPrincipal[];
+  /**
+   * The actors authenticated because `Context.routeActivity()` fetched the
+   * activity again from their own web origin.  It is always empty for
+   * activities delivered to an inbox.
+   */
+  readonly originAuthenticated: readonly InboxPrincipal[];
+  /**
+   * The activity as Fedify interpreted it while authenticating it, in
+   * expanded JSON-LD.  Typed vocabulary objects omit some values, such as
+   * blank node references and values they cannot decode, so authorization
+   * that has to count every value of a property, e.g., that a property has
+   * exactly one value, should inspect this instead.  It is deeply frozen.
+   * It is empty when there is no evidence.
+   */
+  readonly expandedActivity: readonly Record<string, unknown>[];
+  /**
+   * The base URL the activity was decoded with, e.g., the URL an activity
+   * fetched by `Context.routeActivity()` was finally retrieved from, or
+   * `null` if none was given.  Relative IRIs left in
+   * {@link expandedActivity} resolve against it, or against the activity's
+   * own `@id` if it is `null`, as the decoder resolves them.
+   */
+  readonly baseUrl: URL | null;
+}
+/**
+ * A {@link InboxPrincipal} as stored in a queued message.
+ * @internal
+ */
+interface SerializedInboxPrincipal {
+  readonly kind: InboxPrincipal["kind"];
+  readonly id: string;
+  readonly mechanism: InboxPrincipal["mechanism"];
+  readonly keyId: string | null;
+}
+/**
+ * The principals of an {@link InboxAuthenticationEvidence} as stored in
+ * a queued message.  The expanded activity and the base URL are restored
+ * from the queued verified view instead.
+ * @internal
+ */
+interface SerializedInboxAuthentication {
+  readonly verified: boolean;
+  readonly requestSigners: readonly SerializedInboxPrincipal[];
+  readonly documentSigners: readonly SerializedInboxPrincipal[];
+  readonly originAuthenticated: readonly SerializedInboxPrincipal[];
+}
+//#endregion
+//#region src/sig/ld.d.ts
+/**
+ * How a context loader marked by {@link markEffectiveContextLoader} already
+ * resolves contexts.
+ * @internal
+ */
+type EffectiveContextLoaderPolicy = "standard" | "normalization";
+//#endregion
+//#region src/federation/inbox-view.d.ts
+/**
+ * A {@link ContextSnapshotEntry} as stored in a queued message.  A response
+ * that equals the one Fedify bundles for the URL is stored as a reference to
+ * the bundled context, along with its hash for diagnostics.
+ * @internal
+ */
+type SerializedContextSnapshotEntry = {
+  readonly policy: EffectiveContextLoaderPolicy;
+  readonly url: string; /** The SHA-256 of the canonical JSON of the whole response. */
+  readonly sha256: string;
+} & ({
+  readonly bundled: true;
+} | {
+  readonly response: RemoteDocument;
+});
+/**
+ * The interpretation of an incoming activity that Fedify authenticated, as
+ * stored in a queued message.  The document itself is not copied; it is
+ * a field of the message.
+ * @internal
+ */
+interface SerializedVerifiedActivityView {
+  /** The format version. */
+  readonly version: 1;
+  /** The context loader policy the activity was parsed with. */
+  readonly policy: EffectiveContextLoaderPolicy;
+  /**
+   * Which document the activity was parsed from, with its Linked Data
+   * Signature detached: the `activity` of the message, i.e., the payload as
+   * received, or its `normalizedActivity`, i.e., the payload compacted for
+   * Linked Data Signatures.
+   */
+  readonly source: "activity" | "normalizedActivity";
+  /** The `baseUrl` option the activity was parsed with. */
+  readonly baseUrl: string | null;
+  /** The context responses the interpretation used. */
+  readonly contexts: readonly SerializedContextSnapshotEntry[];
+  /** The digest of the expanded activity. */
+  readonly expandedDigest: string;
+}
+//#endregion
 //#region src/federation/retry.d.ts
 /**
  * The context passed to a {@link RetryPolicy} callback.
@@ -1683,6 +1901,21 @@ interface InboxMessage {
    * @internal
    */
   readonly ldSignatureVerified?: boolean;
+  /**
+   * The interpretation of the activity that Fedify authenticated, i.e., which
+   * document it was parsed from and every JSON-LD context response the parse
+   * used, so that the worker and its retries dispatch the very same
+   * interpretation without loading contexts again.  Absent in messages queued
+   * by older Fedify versions.
+   * @internal
+   */
+  readonly verifiedView?: SerializedVerifiedActivityView;
+  /**
+   * Who Fedify authenticated for the activity.  Absent in messages queued by
+   * older Fedify versions.
+   * @internal
+   */
+  readonly authentication?: SerializedInboxAuthentication;
   readonly started: string;
   readonly attempt: number;
   readonly identifier: string | null;
@@ -3034,11 +3267,27 @@ interface InboxListenerSetters<TContextData> {
   /**
    * Registers a listener for a specific incoming activity type.
    *
+   * @example
+   * ``` typescript
+   * federation
+   *   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+   *   // Mastodon sends FeatureRequest activities without an actor:
+   *   .on(FeatureRequest, async (ctx, request) => {
+   *     const verification = await featureInteraction.verifyRequest(ctx, {
+   *       request,
+   *       authentication: ctx.authentication,
+   *     });
+   *     // ...
+   *   }, { allowActorless: true });
+   * ```
+   *
    * @param type A subclass of {@link Activity} to listen to.
    * @param listener A callback to handle an incoming activity.
+   * @param options Options for the listener.  See
+   *                {@link InboxListenerOptions}.  (Since 2.5.0.)
    * @returns The setters object so that settings can be chained.
    */
-  on<TActivity extends Activity>(type: new (...args: any[]) => TActivity, listener: InboxListener<TContextData, TActivity>): InboxListenerSetters<TContextData>;
+  on<TActivity extends Activity>(type: new (...args: any[]) => TActivity, listener: InboxListener<TContextData, TActivity>, options?: InboxListenerOptions): InboxListenerSetters<TContextData>;
   /**
    * Registers an error handler for inbox listeners.  Any exceptions thrown
    * from the listeners are caught and passed to this handler.
@@ -4446,6 +4695,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Successful results are reused for this request regardless of the options.
+   * Pending checks and `null` results are reused for the same effective
+   * document and context loaders, including failed lookups.  Rejected checks
+   * can be retried.  Shared work uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4459,6 +4713,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Successful results are reused for this request regardless of the options.
+   * Pending checks and `null` results are reused for the same effective
+   * document and context loaders, including failed lookups.  Rejected checks
+   * can be retried.  Shared work uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4478,6 +4737,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the owner of the signed key, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Verified keys and owners are reused for this request regardless of the
+   * options.  Pending checks are shared for the same effective document and
+   * context loaders.  A `null` result from an owner lookup after key
+   * verification is retained for those loaders.  A `null` result caused by
+   * an unverified key is not retained, allowing an owner lookup after another
+   * loader verifies the key.  Rejected checks can be retried.  Shared work
+   * uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4492,6 +4759,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the owner of the signed key, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Verified keys and owners are reused for this request regardless of the
+   * options.  Pending checks are shared for the same effective document and
+   * context loaders.  A `null` result from an owner lookup after key
+   * verification is retained for those loaders.  A `null` result caused by
+   * an unverified key is not retained, allowing an owner lookup after another
+   * loader verifies the key.  Rejected checks can be retried.  Shared work
+   * uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4566,6 +4841,17 @@ interface InboxContext<TContextData> extends Context<TContextData> {
    * @since 1.2.0
    */
   readonly recipient: string | null;
+  /**
+   * Who Fedify authenticated for the incoming activity, independently of its
+   * declared `actor`, and the interpretation of the activity that was
+   * authenticated.  It is preserved through the inbox queue and its retries.
+   *
+   * Use it with {@link isActorAuthenticated} to authorize requests that do
+   * not declare an `actor`, which reach a listener only if it is registered
+   * with the `allowActorless` option.
+   * @since 2.5.0
+   */
+  readonly authentication: InboxAuthenticationEvidence;
   /**
    * Creates a new context with the same properties as this one,
    * but with the given data.

package/dist/testing/mod.mjs

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as testDefinitions } from "../dist-DJQM4u7i.mjs";
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-8Tu9kea0.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-COHd1Rsh.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
-import "../testing-t8xDeJZ5.mjs";
+import "../testing-Dbr21vZk.mjs";
 export { ManualClockKvStore, MockQueue, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };

package/dist/{testing-t8xDeJZ5.mjs → testing-Dbr21vZk.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "./dist-DJQM4u7i.mjs";
-import "./context-8Tu9kea0.mjs";
+import "./context-COHd1Rsh.mjs";
 import "./kv-DBRWVx3Q.mjs";
 import "./tasks-IG3pHfvZ.mjs";
 export {};