@fedify/fedify 2.5.0-dev.2494 → 2.5.0-dev.2500

package/dist/{builder-Y3pokaG2.mjs → builder-SNy83ctF.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-D7blYLbb.mjs";
+import { n as version, t as name } from "./deno-CsxrXtWa.mjs";
 import { t as ActivityListenerSet } from "./activity-listener-CELFAodc.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
@@ -91,7 +91,7 @@ var FederationBuilderImpl = class {
 	* specified.
 	*/
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-BE4JXx-U.mjs");
+		const { FederationImpl } = await import("./middleware-CDgUvT3j.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { in as ActivityTransformer, n as Context } from "../context-DSuL3YWx.cjs";
+import { in as ActivityTransformer, n as Context } from "../context-De6_qvb7.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { in as ActivityTransformer, n as Context } from "../context-DQJE9YfH.js";
+import { in as ActivityTransformer, n as Context } from "../context-TVf3fdlB.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { O as actorDehydrator, k as autoIdAssigner, n as FederationImpl } from "../middleware-BEaUojg7.mjs";
+import { O as actorDehydrator, k as autoIdAssigner, n as FederationImpl } from "../middleware-CM2qToci.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 //#region src/compat/transformers.test.ts

package/dist/{compound-proof-BM7AINht.mjs → compound-proof-CuPaRl9U.mjs}

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as getRawCanonicalPortableId, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { c as getNormalizationContextLoader } from "./ld-DUeBHFWH.mjs";
+import { c as getNormalizationContextLoader } from "./ld-DjN0ClIo.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
-import { c as verifyMapLocalProof, f as verifyPortableObjectProofPolicy, m as verifyPreparedPortableObjectProofPolicy, n as classifyFep2277CoreType, o as preparePortableObjectProofPolicy } from "./proof-DQh2z9fx.mjs";
+import { c as verifyMapLocalProof, f as verifyPortableObjectProofPolicy, m as verifyPreparedPortableObjectProofPolicy, n as classifyFep2277CoreType, o as preparePortableObjectProofPolicy } from "./proof-WYcq-_qG.mjs";
 import { parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/sig/compound-proof.ts

package/dist/{context-COHd1Rsh.mjs → context-A-Nde3u-.mjs}

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as mockDocumentLoader } from "./dist-DJQM4u7i.mjs";
 import { t as isInAudience } from "./audience-CHQ-FlLD.mjs";
-import { i as getEmptyAuthenticationEvidence } from "./inbox-authentication-DflPYlLL.mjs";
+import { i as getEmptyAuthenticationEvidence } from "./inbox-authentication-CgonVRkg.mjs";
 import { RouterError } from "@fedify/uri-template";
 import { lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";

package/dist/{context-DSuL3YWx.d.cts → context-De6_qvb7.d.cts}

@@ -77,7 +77,7 @@ type InboxAuthentication = {
     * [FEP-fe34]: https://w3id.org/fep/fe34
     * @since 2.5.0
     */
-    readonly type: "activityOriginMismatch";
+    readonly type: "activity-origin-mismatch";
     readonly activityId: URL;
     readonly actorIds: readonly URL[];
   } | {
@@ -86,7 +86,7 @@ type InboxAuthentication = {
     * for it, although its listener allows activities without an actor.
     * @since 2.5.0
     */
-    readonly type: "noAuthenticatedPrincipal";
+    readonly type: "no-authenticated-principal";
   };
 } | {
   readonly status: "skipped";
@@ -1155,27 +1155,27 @@ interface InboxPrincipal {
   *
   *  -  `"actor"`: an actor whose ownership of the verifying key Fedify
   *     confirmed with the actor's own document.
-  *  -  `"portableAuthority"`: a DID whose verification method made a valid
+  *  -  `"portable-authority"`: a DID whose verification method made a valid
   *     Object Integrity Proof.  It authenticates the [FEP-ef61] portable
   *     actors of that DID, and nothing else.
   *
   * [FEP-ef61]: https://w3id.org/fep/ef61
   */
-  readonly kind: "actor" | "portableAuthority";
-  /** The actor ID, or the DID if {@link kind} is `"portableAuthority"`. */
+  readonly kind: "actor" | "portable-authority";
+  /** The actor ID, or the DID if {@link kind} is `"portable-authority"`. */
   readonly id: URL;
   /**
   * How the principal was authenticated:
   *
-  *  -  `"httpSignatures"`: it signed the HTTP request.
-  *  -  `"linkedDataSignatures"`: it made the Linked Data Signature of the
+  *  -  `"http-signatures"`: it signed the HTTP request.
+  *  -  `"linked-data-signatures"`: it made the Linked Data Signature of the
   *     activity.
-  *  -  `"objectIntegrityProofs"`: it made an Object Integrity Proof of the
+  *  -  `"object-integrity-proofs"`: it made an Object Integrity Proof of the
   *     activity.
   *  -  `"origin"`: the activity was fetched again from the actor's own web
   *     origin, which happens only for `Context.routeActivity()`.
   */
-  readonly mechanism: "httpSignatures" | "linkedDataSignatures" | "objectIntegrityProofs" | "origin";
+  readonly mechanism: "http-signatures" | "linked-data-signatures" | "object-integrity-proofs" | "origin";
   /** The key or verification method that authenticated the principal. */
   readonly keyId: URL | null;
 }
@@ -1285,12 +1285,13 @@ interface IsActorAuthenticatedOptions {
 declare function isActorAuthenticated(evidence: InboxAuthenticationEvidence, actorId: URL, options?: IsActorAuthenticatedOptions): boolean;
 /**
 * A {@link InboxPrincipal} as stored in a queued message.
+* The wire spellings remain independent of the public API spellings.
 * @internal
 */
 interface SerializedInboxPrincipal {
-  readonly kind: InboxPrincipal["kind"];
+  readonly kind: "actor" | "portableAuthority";
   readonly id: string;
-  readonly mechanism: InboxPrincipal["mechanism"];
+  readonly mechanism: "httpSignatures" | "linkedDataSignatures" | "objectIntegrityProofs" | "origin";
   readonly keyId: string | null;
 }
 /**

package/dist/{context-DQJE9YfH.d.ts → context-TVf3fdlB.d.ts}

@@ -79,7 +79,7 @@ type InboxAuthentication = {
     * [FEP-fe34]: https://w3id.org/fep/fe34
     * @since 2.5.0
     */
-    readonly type: "activityOriginMismatch";
+    readonly type: "activity-origin-mismatch";
     readonly activityId: URL;
     readonly actorIds: readonly URL[];
   } | {
@@ -88,7 +88,7 @@ type InboxAuthentication = {
     * for it, although its listener allows activities without an actor.
     * @since 2.5.0
     */
-    readonly type: "noAuthenticatedPrincipal";
+    readonly type: "no-authenticated-principal";
   };
 } | {
   readonly status: "skipped";
@@ -1157,27 +1157,27 @@ interface InboxPrincipal {
   *
   *  -  `"actor"`: an actor whose ownership of the verifying key Fedify
   *     confirmed with the actor's own document.
-  *  -  `"portableAuthority"`: a DID whose verification method made a valid
+  *  -  `"portable-authority"`: a DID whose verification method made a valid
   *     Object Integrity Proof.  It authenticates the [FEP-ef61] portable
   *     actors of that DID, and nothing else.
   *
   * [FEP-ef61]: https://w3id.org/fep/ef61
   */
-  readonly kind: "actor" | "portableAuthority";
-  /** The actor ID, or the DID if {@link kind} is `"portableAuthority"`. */
+  readonly kind: "actor" | "portable-authority";
+  /** The actor ID, or the DID if {@link kind} is `"portable-authority"`. */
   readonly id: URL;
   /**
   * How the principal was authenticated:
   *
-  *  -  `"httpSignatures"`: it signed the HTTP request.
-  *  -  `"linkedDataSignatures"`: it made the Linked Data Signature of the
+  *  -  `"http-signatures"`: it signed the HTTP request.
+  *  -  `"linked-data-signatures"`: it made the Linked Data Signature of the
   *     activity.
-  *  -  `"objectIntegrityProofs"`: it made an Object Integrity Proof of the
+  *  -  `"object-integrity-proofs"`: it made an Object Integrity Proof of the
   *     activity.
   *  -  `"origin"`: the activity was fetched again from the actor's own web
   *     origin, which happens only for `Context.routeActivity()`.
   */
-  readonly mechanism: "httpSignatures" | "linkedDataSignatures" | "objectIntegrityProofs" | "origin";
+  readonly mechanism: "http-signatures" | "linked-data-signatures" | "object-integrity-proofs" | "origin";
   /** The key or verification method that authenticated the principal. */
   readonly keyId: URL | null;
 }
@@ -1287,12 +1287,13 @@ interface IsActorAuthenticatedOptions {
 declare function isActorAuthenticated(evidence: InboxAuthenticationEvidence, actorId: URL, options?: IsActorAuthenticatedOptions): boolean;
 /**
 * A {@link InboxPrincipal} as stored in a queued message.
+* The wire spellings remain independent of the public API spellings.
 * @internal
 */
 interface SerializedInboxPrincipal {
-  readonly kind: InboxPrincipal["kind"];
+  readonly kind: "actor" | "portableAuthority";
   readonly id: string;
-  readonly mechanism: InboxPrincipal["mechanism"];
+  readonly mechanism: "httpSignatures" | "linkedDataSignatures" | "objectIntegrityProofs" | "origin";
   readonly keyId: string | null;
 }
 /**

package/dist/{deno-D7blYLbb.mjs → deno-CsxrXtWa.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2494+f2e9b5d3";
+var version = "2.5.0-dev.2500+0a9d005b";
 //#endregion
 export { version as n, name as t };

package/dist/{docloader-DbBbDaY-.mjs → docloader--D95F073.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { D as validateCryptoKey } from "./ld-DUeBHFWH.mjs";
-import { r as doubleKnockScoped } from "./http-CxKd10Lq.mjs";
+import { D as validateCryptoKey } from "./ld-DjN0ClIo.mjs";
+import { r as doubleKnockScoped } from "./http-CVDBHMLY.mjs";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, resolveDocumentLoaderTimeout, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/federation/builder.test.mjs

@@ -7,7 +7,7 @@ import { t as assertExists } from "../assert_exists-cffSpJ7X.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
-import { r as createFederationBuilder } from "../builder-Y3pokaG2.mjs";
+import { r as createFederationBuilder } from "../builder-SNy83ctF.mjs";
 import { DisallowedOperatorError, DisallowedVarSpecModifierError, DuplicateRouteVariableError, RouteTemplateOptionsNotMatchedError, RouterError } from "@fedify/uri-template";
 import { Activity, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/federation/compound-fanout.test.mjs

@@ -6,11 +6,11 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { x as exportJwk } from "../ld-DUeBHFWH.mjs";
+import { x as exportJwk } from "../ld-DjN0ClIo.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { h as verifyProof, s as signObject } from "../proof-DQh2z9fx.mjs";
+import { h as verifyProof, s as signObject } from "../proof-WYcq-_qG.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl } from "../middleware-BEaUojg7.mjs";
+import { n as FederationImpl } from "../middleware-CM2qToci.mjs";
 import { Create, DataIntegrityProof, Note } from "@fedify/vocab";
 import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/federation/handler-compound-proof.test.mjs

@@ -1,14 +1,14 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext, t as createInboxContext } from "../context-COHd1Rsh.mjs";
+import { r as createRequestContext, t as createInboxContext } from "../context-A-Nde3u-.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as compactJsonLd, h as verifyCompactJsonLd, m as signJsonLd } from "../ld-DUeBHFWH.mjs";
-import { u as signRequest } from "../http-CxKd10Lq.mjs";
+import { a as compactJsonLd, h as verifyCompactJsonLd, m as signJsonLd } from "../ld-DjN0ClIo.mjs";
+import { u as signRequest } from "../http-CVDBHMLY.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, o as createFederation } from "../middleware-BEaUojg7.mjs";
+import { f as handleInbox, o as createFederation } from "../middleware-CM2qToci.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-CELFAodc.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { Create, CryptographicKey, Multikey, Person, Update } from "@fedify/vocab";

package/dist/federation/handler.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-COHd1Rsh.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-A-Nde3u-.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertGreaterOrEqual } from "../assert_greater_or_equal-BlafOF4-.mjs";
@@ -11,11 +11,11 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as parseAcceptSignature } from "../accept-CPVqki78.mjs";
-import { T as generateCryptoKeyPair, a as compactJsonLd, m as signJsonLd } from "../ld-DUeBHFWH.mjs";
-import { s as signObject } from "../proof-DQh2z9fx.mjs";
-import { u as signRequest } from "../http-CxKd10Lq.mjs";
+import { T as generateCryptoKeyPair, a as compactJsonLd, m as signJsonLd } from "../ld-DjN0ClIo.mjs";
+import { s as signObject } from "../proof-WYcq-_qG.mjs";
+import { u as signRequest } from "../http-CVDBHMLY.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { d as handleCustomCollection, f as handleInbox, g as respondWithObjectIfAcceptable, h as respondWithObject, l as handleActor, m as handleOutbox, o as createFederation, p as handleObject, u as handleCollection } from "../middleware-BEaUojg7.mjs";
+import { d as handleCustomCollection, f as handleInbox, g as respondWithObjectIfAcceptable, h as respondWithObject, l as handleActor, m as handleOutbox, o as createFederation, p as handleObject, u as handleCollection } from "../middleware-CM2qToci.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-CELFAodc.mjs";
 import { t as FedifySpanExporter } from "../exporter-DVG68ozH.mjs";
 import { configure, getLogger, reset, withContext } from "@logtape/logtape";
@@ -4940,6 +4940,7 @@ test("handleInbox() nonce consumption on valid signed request", async () => {
 });
 test("handleInbox() nonce replay prevention", async () => {
 	const [meterProvider, recorder] = createTestMeterProvider();
+	const [tracerProvider, spanExporter] = createTestTracerProvider();
 	const activity = new Create({
 		id: new URL("https://example.com/activities/nonce-3"),
 		actor: new URL("https://example.com/person2"),
@@ -4962,7 +4963,8 @@ test("handleInbox() nonce replay prevention", async () => {
 	const context = createRequestContext({
 		federation: createFederation({
 			kv: new MemoryKvStore(),
-			meterProvider
+			meterProvider,
+			tracerProvider
 		}),
 		request: signedRequest,
 		url: new URL(signedRequest.url),
@@ -4998,6 +5000,7 @@ test("handleInbox() nonce replay prevention", async () => {
 		signatureTimeWindow: { minutes: 5 },
 		skipSignatureVerification: false,
 		meterProvider,
+		tracerProvider,
 		inboxChallengePolicy: {
 			enabled: true,
 			requestNonce: true,
@@ -5011,6 +5014,7 @@ test("handleInbox() nonce replay prevention", async () => {
 		reason: { type: "invalidNonce" }
 	});
 	assertEquals(report.attempts.at(-1)?.status, "verified");
+	assertEquals(spanExporter.getSpans("activitypub.inbox")[0].attributes["activitypub.verification.failure_reason"], "invalidNonce");
 	const acceptSig = response.headers.get("Accept-Signature");
 	assert(acceptSig != null, "Must emit fresh Accept-Signature challenge");
 	const parsed = parseAcceptSignature(acceptSig);

package/dist/federation/hashlink-media.test.mjs

@@ -10,8 +10,8 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as createFederation, x as parseHashlinkGatewayRequest } from "../middleware-BEaUojg7.mjs";
-import { r as createFederationBuilder } from "../builder-Y3pokaG2.mjs";
+import { o as createFederation, x as parseHashlinkGatewayRequest } from "../middleware-CM2qToci.mjs";
+import { r as createFederationBuilder } from "../builder-SNy83ctF.mjs";
 import { n as RouterError } from "../router-u5O5KCQr.mjs";
 import { Note } from "@fedify/vocab";
 import { computeDigestMultibase, encodeMultibase, exportDidKey } from "@fedify/vocab-runtime";

package/dist/federation/idempotency.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { s as signObject } from "../proof-DQh2z9fx.mjs";
+import { s as signObject } from "../proof-WYcq-_qG.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { o as createFederation } from "../middleware-BEaUojg7.mjs";
+import { o as createFederation } from "../middleware-CM2qToci.mjs";
 import { Create, Follow, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/federation/idempotency.test.ts

package/dist/federation/inbox-actorless.test.mjs

@@ -1,21 +1,22 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { a as isActorAuthenticated } from "../inbox-authentication-DflPYlLL.mjs";
+import { a as isActorAuthenticated } from "../inbox-authentication-CgonVRkg.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { m as signJsonLd } from "../ld-DUeBHFWH.mjs";
-import { s as signObject } from "../proof-DQh2z9fx.mjs";
-import { u as signRequest } from "../http-CxKd10Lq.mjs";
-import { a as rsaPrivateKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { o as createFederation } from "../middleware-BEaUojg7.mjs";
-import { c as expandDocument } from "../inbox-view-BJ5DBPFo.mjs";
-import { Create, FeatureRequest, Person } from "@fedify/vocab";
+import { m as signJsonLd } from "../ld-DjN0ClIo.mjs";
+import { s as signObject } from "../proof-WYcq-_qG.mjs";
+import { u as signRequest } from "../http-CVDBHMLY.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { o as createFederation } from "../middleware-CM2qToci.mjs";
+import { c as expandDocument } from "../inbox-view-BV7f1seI.mjs";
+import { t as KvKeyCache } from "../keycache-N2opu4-3.mjs";
+import { Create, CryptographicKey, FeatureRequest, Person } from "@fedify/vocab";
 import { FetchError, encodeMultibase, preloadedContexts } from "@fedify/vocab-runtime";
-import { mockDocumentLoader, test } from "@fedify/fixture";
+import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import serialize from "json-canon";
 //#region src/federation/inbox-actorless.test.ts
 const SIGNER = new URL("https://example.com/person2");
@@ -54,6 +55,8 @@ var CapturingQueue = class {
 };
 function setup(options = {}) {
 	const received = [];
+	const reports = [];
+	const [tracerProvider, spanExporter] = createTestTracerProvider();
 	let mutableLoads = 0;
 	const loader = async (url, loaderOptions) => {
 		options.contextLoads?.push(url);
@@ -90,7 +93,8 @@ function setup(options = {}) {
 		return await mockDocumentLoader(url, loaderOptions);
 	};
 	const federation = createFederation({
-		kv: new MemoryKvStore(),
+		kv: options.kv ?? new MemoryKvStore(),
+		tracerProvider,
 		documentLoaderFactory: () => loader,
 		contextLoaderFactory: () => loader,
 		authenticatedDocumentLoaderFactory: () => loader,
@@ -114,10 +118,14 @@ function setup(options = {}) {
 			authentication: ctx.authentication,
 			rawActivity: ctx.activity
 		});
-	}, { allowActorless: options.allowActorless ?? true }).on(Create, () => {});
+	}, { allowActorless: options.allowActorless ?? true }).on(Create, () => {}).onRequestFinished((_ctx, report) => {
+		reports.push(report);
+	});
 	return {
 		federation,
-		received
+		received,
+		reports,
+		spanExporter
 	};
 }
 function post(body) {
@@ -201,7 +209,7 @@ test("Actorless FeatureRequest authenticated by HTTP Signatures", async () => {
 	]), [[
 		"actor",
 		SIGNER.href,
-		"httpSignatures"
+		"http-signatures"
 	]]);
 	assert(isActorAuthenticated(authentication, SIGNER));
 	assertFalse(isActorAuthenticated(authentication, SIGNER, { scope: "document" }));
@@ -212,7 +220,7 @@ test("Actorless FeatureRequest authenticated by Linked Data Signatures", async (
 	const document = await withLds(featureRequestDocument());
 	assertEquals((await federation.fetch(post(document), { contextData: void 0 })).status, 202);
 	assertEquals(received.length, 1);
-	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "linkedDataSignatures"]]);
+	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "linked-data-signatures"]]);
 	assertEquals(received[0].rawActivity, document);
 });
 test("Actorless FeatureRequest authenticated by Object Integrity Proofs", async () => {
@@ -228,7 +236,7 @@ test("Actorless FeatureRequest authenticated by Object Integrity Proofs", async
 	]), [[
 		"actor",
 		SIGNER.href,
-		"objectIntegrityProofs",
+		"object-integrity-proofs",
 		ED25519_KEY.href
 	]]);
 });
@@ -245,9 +253,36 @@ test("Actorless activities need an authenticated principal", async () => {
 	assertEquals(received, []);
 });
 test("Actorless activities need the same origin as their signer", async () => {
-	const { federation, received } = setup();
+	const { federation, received, reports, spanExporter } = setup();
 	assertEquals((await federation.fetch(await postSigned(featureRequestDocument({ id: "https://other.example/requests/1" })), { contextData: void 0 })).status, 401);
 	assertEquals(received, []);
+	assertEquals(reports[0].authentication, {
+		status: "rejected",
+		reason: {
+			type: "activity-origin-mismatch",
+			activityId: new URL("https://other.example/requests/1"),
+			actorIds: [SIGNER]
+		}
+	});
+	assertEquals(spanExporter.getSpans("activitypub.inbox")[0].attributes["activitypub.verification.failure_reason"], "activity-origin-mismatch");
+});
+test("Actorless activities reject a verified key with no authenticated principal", async () => {
+	const kv = new MemoryKvStore();
+	await new KvKeyCache(kv, ["_fedify", "publicKey"], { contextLoader: mockDocumentLoader }).set(RSA_KEY, new CryptographicKey({
+		id: RSA_KEY,
+		publicKey: rsaPublicKey3.publicKey
+	}));
+	const { federation, received, reports, spanExporter } = setup({ kv });
+	const response = await federation.fetch(await postSigned(featureRequestDocument()), { contextData: void 0 });
+	assertEquals(response.status, 401);
+	assertEquals(await response.text(), "No principal is authenticated for the activity.");
+	assertEquals(received, []);
+	assertEquals(reports[0].authentication, {
+		status: "rejected",
+		reason: { type: "no-authenticated-principal" }
+	});
+	assertEquals(reports[0].attempts.at(-1)?.status, "verified");
+	assertEquals(spanExporter.getSpans("activitypub.inbox")[0].attributes["activitypub.verification.failure_reason"], "no-authenticated-principal");
 });
 for (const [label, actor] of [
 	["an anonymous actor", {
@@ -372,7 +407,7 @@ test("Activities with an actor expose their evidence", async () => {
 		p.keyId?.href
 	]), [[
 		SIGNER.href,
-		"httpSignatures",
+		"http-signatures",
 		RSA_KEY.href
 	]]);
 });
@@ -382,7 +417,7 @@ test("An author's proof is preferred to a relay's Linked Data Signature", async
 	const document = await signJsonLd(await withRawProof(featureRequestDocument()), rsaPrivateKey2, relayKey, { contextLoader: mockDocumentLoader });
 	assertEquals((await federation.fetch(post(document), { contextData: void 0 })).status, 202);
 	assertEquals(received.length, 1);
-	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "objectIntegrityProofs"]]);
+	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "object-integrity-proofs"]]);
 });
 test("A proof that cannot be verified for now is not superseded", async () => {
 	const { federation, received } = setup({ unavailable: ["https://example.com/person2", "https://example.com/person2#key4"] });
@@ -404,7 +439,7 @@ test("Context.routeActivity() exposes the evidence of verified proofs", async ()
 	});
 	assert(await federation.createContext(new URL("https://example.com/"), void 0).routeActivity("alice", activity));
 	assertEquals(received.length, 1);
-	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "objectIntegrityProofs"]]);
+	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "object-integrity-proofs"]]);
 	assertEquals(received[0].authentication.originAuthenticated, []);
 });
 test("An author's aliased proof is preferred to a relay's signature", async () => {
@@ -412,7 +447,7 @@ test("An author's aliased proof is preferred to a relay's signature", async () =
 	const document = await signJsonLd(await withRawProof(featureRequestDocument(), "integrity"), rsaPrivateKey2, RELAY_KEY, { contextLoader: mockDocumentLoader });
 	assertEquals((await federation.fetch(post(document), { contextData: void 0 })).status, 202);
 	assertEquals(received.length, 1);
-	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "objectIntegrityProofs"]]);
+	assertEquals(received[0].authentication.documentSigners.map((p) => [p.id.href, p.mechanism]), [[SIGNER.href, "object-integrity-proofs"]]);
 });
 for (const queued of [false, true]) test(`Context.routeActivity() keeps the fetched interpretation (queued: ${queued})`, async () => {
 	const queue = queued ? new CapturingQueue() : void 0;