@fedify/fedify 2.4.0-dev.2065 → 2.4.0-dev.2071

package/dist/{middleware-s-AZzx4r.mjs → middleware-CPx4ZWwt.mjs}

@@ -1,27 +1,27 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BuRFI7wk.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DOqknlZd.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B5Rei-HC.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-BxHsA1s9.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-f1qaBtOh.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-_aSNLA90.mjs";
-import { n as kvCache } from "./kv-cache-C9IY-FMN.mjs";
+import { d as hasPortableActor, f as isCompatibleKeyId, m as isPortableUri, o as importJwk, s as validateCryptoKey, t as exportJwk, u as getGatewayKeyBase } from "./key-lfcx_NaE.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-jyjdrWjG.mjs";
+import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-B6gwdhN5.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DKWi8RjI.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-C6yOVoaF.mjs";
+import { n as kvCache } from "./kv-cache-d8EjO29d.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CqJq5erX.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-D_F22lfM.mjs";
-import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-B03JXhrk.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-NNkfKtVN.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CMkrnYbY.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-ByqNQVaa.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-DsK7xevO.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-DVQ0yhKJ.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-Dj3DCsoj.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-KmXDfWFp.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-VVVSuruq.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Bw5jtrBY.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -858,13 +858,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -905,7 +905,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -945,7 +945,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -961,7 +961,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -1653,6 +1653,7 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let activity = null;
 	let activityVerified = false;
+	let proofVerified = false;
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -1669,6 +1670,21 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		if (!skipSignatureVerification && hasPortableActor(activity)) try {
+			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			}) != null;
+		} catch (error) {
+			if (!isPermanentActivityParseError(error)) throw error;
+			logger.debug("Failed to verify the Object Integrity Proofs of the portable actor's activity:\n{error}", {
+				recipient,
+				error
+			});
+		}
 	} else {
 		logger.debug("Linked Data Signatures are not verified.", {
 			recipient,
@@ -1725,6 +1741,7 @@ async function handleInboxInternal(request, parameters, span) {
 				activity: json
 			});
 			activityVerified = true;
+			proofVerified = true;
 		}
 	}
 	let httpSigKey = null;
@@ -1837,6 +1854,24 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
+	if (!skipSignatureVerification && !proofVerified && (hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
+			activity: json,
+			recipient,
+			activityId: activity.id?.href,
+			actorId: activity.actorId?.href,
+			keyId: httpSigKey?.id?.href
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity of the portable actor (${activity.actorId?.href}) is not authenticated by a valid Object Integrity Proof.`
+		});
+		return new Response("Activities of portable actors must have valid Object Integrity Proofs.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
@@ -2054,8 +2089,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -2539,6 +2574,15 @@ const MIN_COMPONENTS = [
 	"@target-uri",
 	"@authority"
 ];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableUri(key.ownerId);
+}
 //#endregion
 //#region src/federation/outgoing-proof.ts
 function isPortableUrl(url) {
@@ -2548,37 +2592,48 @@ function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
+* Rejects an activity of a portable actor whose ID cannot be authenticated by
+* the actor's DID: FEP-ef61 requires the activity to be a portable object
+* signed by that DID, so its ID has to be a portable ID with the same DID.
+* @throws {TypeError} If the activity is performed by a portable actor, but
+*                     its ID is not a portable ID of the actor's DID, or its
+*                     portable actors do not share a DID.
+* @internal
+*/
+function assertPortableActorActivity(activity) {
+	const portableActors = activity.actorIds.filter(isPortableUrl);
+	if (portableActors.length < 1) return;
+	const did = getFe34Origin(portableActors[0]);
+	if (portableActors.some((actorId) => getFe34Origin(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !isPortableUrl(activity.id) || getFe34Origin(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+}
+/**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
+* Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
+* never sign proofs.  A portable activity, i.e., one with an `ap:` or
+* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* whose verification method is a DID URL for its DID, even if it is the only
+* key; if no key or more than one key qualifies, this function throws.
+*
 * Outside the map-local compound-proof profile, i.e., when the activity
 * embeds no portable object, every Ed25519 key signs the activity, as it
 * always has.  Inside the profile, which accepts exactly one direct proof per
 * map, Fedify creates at most one proof:
 *
 *  -  An activity that already carries a proof is kept as is.
-*  -  A single Ed25519 key signs the activity.
-*  -  With several Ed25519 keys, a portable activity is signed by the one key
-*     whose verification method is a DID URL for the activity's DID, the only
-*     proof the FEP-ef61 policy can accept.  If no key or more than one key
-*     qualifies, or the activity is not portable itself, the choice is
-*     ambiguous and this function throws.
+*  -  A single Ed25519 key signs a non-portable activity.
+*  -  With several Ed25519 keys, a non-portable activity is ambiguous, and
+*     this function throws.
 *
-* @throws {TypeError} If a single proof key cannot be chosen.
+* @throws {TypeError} If a single proof key cannot be chosen, or the activity
+*                     is performed by a portable actor but is not a portable
+*                     activity of the same DID.
 * @internal
 */
 async function signOutgoingActivity(activity, candidates, options) {
 	const { contextLoader, tracerProvider } = options;
-	let hasProof = false;
-	for await (const _ of activity.getProofs({ contextLoader })) {
-		hasProof = true;
-		break;
-	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519");
-	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
-		activity,
-		hasProof,
-		proofCreated: false
-	};
+	assertPortableActorActivity(activity);
 	const sign = async (selected) => {
 		for (const { verificationMethod, privateKey } of selected) activity = await signObject(activity, privateKey, verificationMethod, {
 			contextLoader,
@@ -2590,6 +2645,18 @@ async function signOutgoingActivity(activity, candidates, options) {
 			proofCreated: true
 		};
 	};
+	let hasProof = false;
+	for await (const _ of activity.getProofs({ contextLoader })) {
+		hasProof = true;
+		break;
+	}
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
+		activity,
+		hasProof,
+		proofCreated: false
+	};
 	if (keys.length < 2 && !hasProof) return await sign(keys);
 	if (!containsCompoundPortableObject(await activity.toJsonLd({
 		format: "compact",
@@ -2609,15 +2676,26 @@ async function signOutgoingActivity(activity, candidates, options) {
 			proofCreated: false
 		};
 	}
-	if (activity.id == null || !isPortableUrl(activity.id)) throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
-	const activityDid = getFe34Origin(activity.id);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && haveSameFe34Origin(activity.id, c.verificationMethod));
-	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  The map-local compound-proof profile accepts exactly one direct proof per map, and FEP-ef61 requires that proof's verification method to be a DID URL for the activity's DID.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
-	logger.debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID; the map-local compound-proof profile accepts exactly one direct proof per map.", {
-		activityId,
+	throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
+}
+/**
+* Chooses the one Ed25519 key that can sign a portable activity: the key
+* whose verification method is a DID URL for the activity's DID.
+* @throws {TypeError} If no key or more than one key qualifies.
+*/
+function selectPortableActivityKey(activity, activityId, keys) {
+	const activityDid = getFe34Origin(activityId);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && haveSameFe34Origin(activityId, c.verificationMethod));
+	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
+	getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]).debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID.", {
+		activityId: activity.id?.href,
 		keyId: eligible[0].verificationMethod.href
 	});
-	return await sign(eligible);
+	return eligible;
 }
 /**
 * Rejects an outgoing activity whose proofs Fedify's own inbox would reject
@@ -4322,9 +4400,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const contextLoader = this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
 		const activityId = activity.id.href;
 		let rsaKey = null;
+		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
@@ -4345,7 +4424,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		});
 		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
 		assertSupportedCompoundProofShape(jsonLd, activityId);
-		if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		if (rsaKey == null && !ldSignable) logger.debug("The activity {activityId} is performed by a portable actor, so it is sent without a Linked Data signature.", { activityId });
+		else if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
 			keys: keys.map((pair) => ({
 				keyId: pair.keyId.href,
@@ -5221,14 +5301,15 @@ var ContextImpl = class ContextImpl {
 			getActorKeyPairsIdentifier: identifier,
 			actorKeyPairsDispatcherIdentifier: this.invokedFromActorKeyPairsDispatcher.identifier
 		});
+		const portableActor = await this.getPortableActorKeyOwner(identifier);
 		let keyPairs;
 		try {
-			keyPairs = await this.getKeyPairsFromIdentifier(identifier);
+			keyPairs = await this.getKeyPairsFromIdentifier(identifier, portableActor);
 		} catch (_) {
 			logger.warn("No actor key pairs dispatcher registered.");
 			return [];
 		}
-		const owner = this.getActorUri(identifier);
+		const owner = portableActor?.id ?? this.getActorUri(identifier);
 		const result = [];
 		let i = 1;
 		for (const keyPair of keyPairs) {
@@ -5240,7 +5321,7 @@ var ContextImpl = class ContextImpl {
 					publicKey: keyPair.publicKey
 				}),
 				multikey: new Multikey({
-					id: new URL(`#multikey-${i}`, owner),
+					id: portableActor == null ? new URL(`#multikey-${i}`, owner) : keyPair.keyId,
 					controller: owner,
 					publicKey: keyPair.publicKey
 				})
@@ -5250,7 +5331,26 @@ var ContextImpl = class ContextImpl {
 		}
 		return result;
 	}
-	async getKeyPairsFromIdentifier(identifier) {
+	/**
+	* Resolves the portable actor that the actor with the given identifier is,
+	* through the portable actor ID mapper, along with the base of its gateway
+	* key IDs on this server.
+	* @param identifier The actor's identifier.
+	* @returns The portable actor's ID and key ID base, or `null` if the actor
+	*          is not portable.
+	* @throws {TypeError} If the mapper returns an invalid portable actor ID.
+	*/
+	async getPortableActorKeyOwner(identifier) {
+		const mapper = this.federation.actorCallbacks?.portableActorIdMapper;
+		if (mapper == null) return null;
+		const id = await mapper(this, identifier);
+		if (id == null) return null;
+		return {
+			id,
+			keyBase: getGatewayKeyBase(id, this.canonicalOrigin)
+		};
+	}
+	async getKeyPairsFromIdentifier(identifier, portableActor) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
@@ -5267,6 +5367,8 @@ var ContextImpl = class ContextImpl {
 			}
 			throw error;
 		}
+		if (portableActor === void 0) portableActor = await this.getPortableActorKeyOwner(identifier);
+		const keyBase = portableActor?.keyBase ?? actorUri;
 		const keyPairs = await this.federation.actorCallbacks?.keyPairsDispatcher(new ContextImpl({
 			...this,
 			invokedFromActorKeyPairsDispatcher: { identifier }
@@ -5277,7 +5379,7 @@ var ContextImpl = class ContextImpl {
 		for (const keyPair of keyPairs) {
 			result.push({
 				...keyPair,
-				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, actorUri)
+				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, keyBase)
 			});
 			i++;
 		}

package/dist/{middleware-VOCZN3SO.mjs → middleware-CdVnCDXD.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-s-AZzx4r.mjs";
+import { n as FederationImpl } from "./middleware-CPx4ZWwt.mjs";
 export { FederationImpl };

package/dist/{mod-Dhm7SqyE.d.ts → mod-C9WSpZWm.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-65PYi9jY.js";
+import { S as KeyCache } from "./http-n2v6DPxu.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";

package/dist/{mod-C0BYc0OU.d.ts → mod-CVZrXSdm.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-65PYi9jY.js";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-n2v6DPxu.js";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { t as DocumentFetchKind } from "./metrics-DoRtI0qU.js";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-BhMvsgdF.d.ts → mod-DMkflQdF.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ht as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-D_gg4M0n.js";
+import { Ut as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-DsB9kF6q.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-Bfenkg_c.d.cts → mod-DTAaBwiY.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ht as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-b36TpPoG.cjs";
+import { Ut as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-DijrgHDe.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-pLbeNwcC.d.cts → mod-HDSvS-ww.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-CP-7OdSq.cjs";
+import { S as KeyCache } from "./http-xlG-jRdB.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-CyiSjRkk.d.cts → mod-xGFCHqq_.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-CP-7OdSq.cjs";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-xlG-jRdB.cjs";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { t as DocumentFetchKind } from "./metrics-DVKYY6K1.cjs";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";

package/dist/mod.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-BGShIsd6.cjs");
-const require_federation = require("./federation-Coi_bg12.cjs");
+const require_http = require("./http-CuLWIJdf.cjs");
+const require_federation = require("./federation-CUiHc7dP.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-D8ZpRusc.cjs");
-const require_kv_cache = require("./kv-cache-CY6pDNoS.cjs");
+const require_owner = require("./owner-BXufwAzm.cjs");
+const require_kv_cache = require("./kv-cache-DE8kSNQU.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
-const require_sig = require("./sig-B1E2uyhQ.cjs");
+const require_sig = require("./sig-TTn9wYrE.cjs");
 require("./utils/mod.cjs");
 //#endregion
 exports.CircuitBreaker = require_federation.CircuitBreaker;
@@ -21,15 +21,15 @@ exports.Router = require_federation.Router;
 exports.RouterError = require_federation.RouterError;
 exports.SendActivityError = require_federation.SendActivityError;
 exports.actorDehydrator = require_transformers.actorDehydrator;
-exports.attachSignature = require_owner.attachSignature;
+exports.attachSignature = require_http.attachSignature;
 exports.autoIdAssigner = require_transformers.autoIdAssigner;
 exports.buildCollectionSynchronizationHeader = require_federation.buildCollectionSynchronizationHeader;
 exports.createExponentialBackoffPolicy = require_federation.createExponentialBackoffPolicy;
 exports.createFederation = require_federation.createFederation;
 exports.createFederationBuilder = require_federation.createFederationBuilder;
-exports.createProof = require_owner.createProof;
-exports.createSignature = require_owner.createSignature;
-exports.detachSignature = require_owner.detachSignature;
+exports.createProof = require_http.createProof;
+exports.createSignature = require_http.createSignature;
+exports.detachSignature = require_http.detachSignature;
 exports.digest = require_federation.digest;
 exports.doesActorOwnKey = require_owner.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
@@ -43,8 +43,8 @@ exports.getDefaultActivityTransformers = require_transformers.getDefaultActivity
 exports.getKeyOwner = require_owner.getKeyOwner;
 exports.getNodeInfo = require_types.getNodeInfo;
 exports.handleWebFinger = require_federation.handleWebFinger;
-exports.hasProofLike = require_owner.hasProofLike;
-exports.hasSignatureLike = require_owner.hasSignatureLike;
+exports.hasProofLike = require_http.hasProofLike;
+exports.hasSignatureLike = require_http.hasSignatureLike;
 exports.importJwk = require_http.importJwk;
 exports.kvCache = require_kv_cache.kvCache;
 exports.nodeInfoToJson = require_types.nodeInfoToJson;
@@ -54,18 +54,18 @@ exports.parseCircuitBreakerKvState = require_federation.parseCircuitBreakerKvSta
 exports.parseNodeInfo = require_types.parseNodeInfo;
 exports.respondWithObject = require_federation.respondWithObject;
 exports.respondWithObjectIfAcceptable = require_federation.respondWithObjectIfAcceptable;
-exports.signJsonLd = require_owner.signJsonLd;
-exports.signObject = require_owner.signObject;
+exports.signJsonLd = require_http.signJsonLd;
+exports.signObject = require_http.signObject;
 exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
-exports.verifyJsonLd = require_owner.verifyJsonLd;
-exports.verifyObject = require_owner.verifyObject;
+exports.verifyJsonLd = require_http.verifyJsonLd;
+exports.verifyObject = require_http.verifyObject;
 exports.verifyPortableObject = require_sig.verifyPortableObject;
-exports.verifyPortableObjectProof = require_owner.verifyPortableObjectProof;
-exports.verifyProof = require_owner.verifyProof;
+exports.verifyPortableObjectProof = require_http.verifyPortableObjectProof;
+exports.verifyProof = require_http.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;
 exports.verifyRequestDetailed = require_http.verifyRequestDetailed;
-exports.verifySignature = require_owner.verifySignature;
+exports.verifySignature = require_http.verifySignature;
 var _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 Object.keys(_fedify_vocab_runtime).forEach(function(k) {
 	if (k !== "default" && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {

package/dist/mod.d.cts

@@ -1,18 +1,18 @@
 /// <reference lib="esnext.temporal" />
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.cjs";
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-CP-7OdSq.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-xlG-jRdB.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BF0L9cMt.cjs";
-import { $ as MessageQueue, A as ObjectCallbackSetters, At as InboxListener, B as TaskDefinitionOptions, Bt as UnverifiedActivityHandler, C as FederationOptions, Ct as CollectionDispatcher, D as InboxChallengePolicy, Dt as HashlinkMediaDispatcher, E as IdempotencyStrategy, Et as CustomCollectionDispatcher, F as FederationQueueOptions, Ft as OutboxErrorHandler, G as RetryContext, Gt as PageItems, H as TaskHandler, Ht as WebFingerLinksDispatcher, I as createFederation, It as OutboxListener, J as RespondWithObjectOptions, Jt as ActivityTransformer, K as RetryPolicy, Kt as buildCollectionSynchronizationHeader, L as Message, Lt as OutboxListenerErrorHandler, M as Rfc6570Expression, Mt as NodeInfoDispatcher, N as FederationKvPrefixes, Nt as ObjectAuthorizePredicate, O as InboxListenerSetters, Ot as HashlinkMediaRequest, P as FederationOrigin, Pt as ObjectDispatcher, Q as InProcessMessageQueueOptions, R as createFederationBuilder, Rt as OutboxPermanentFailureHandler, S as FederationFetchOptions, St as CollectionCursor, T as IdempotencyKeyCallback, Tt as CustomCollectionCursor, U as TaskRegistry, Ut as SendActivityError, V as TaskEnqueueOptions, Vt as UnverifiedActivityReason, W as CreateExponentialBackoffPolicyOptions, Wt as SenderKeyPair, X as respondWithObjectIfAcceptable, Y as respondWithObject, Z as InProcessMessageQueue, _ as CustomCollectionCallbackSetters, _t as ActorDispatcher, a as GetSignedKeyOptions, at as CircuitBreakerActivityDrop, b as FederationBenchmarkOptions, bt as AuthorizePredicate, c as ParseUriResult, ct as CircuitBreakerFailurePolicy, d as RouteActivityOptions, dt as CircuitBreakerState, et as MessageQueueDepth, f as SendActivityOptions, ft as CircuitBreakerStateChange, g as ConstructorWithTypeId, gt as ActorAliasMapper, h as CollectionCallbackSetters, ht as parseCircuitBreakerKvState, i as GetActorOptions, it as CircuitBreaker, j as OutboxListenerSetters, jt as MediaUploaderCallback, k as MediaUploaderSetters, kt as InboxErrorHandler, l as PortableRequest, lt as CircuitBreakerKvState, m as ActorCallbackSetters, mt as normalizeCircuitBreakerOptions, n as Context, nt as MessageQueueListenOptions, o as InboxContext, ot as CircuitBreakerBeforeSendDecision, p as SendActivityOptionsForCollection, pt as NormalizedCircuitBreakerOptions, q as createExponentialBackoffPolicy, qt as digest, r as ForwardActivityOptions, rt as ParallelMessageQueue, s as OutboxContext, st as CircuitBreakerCreateOptions, t as ActorKeyPair, tt as MessageQueueEnqueueOptions, u as RequestContext, ut as CircuitBreakerOptions, v as Federatable, vt as ActorHandleMapper, w as FederationStartQueueOptions, wt as CustomCollectionCounter, x as FederationBuilder, xt as CollectionCounter, y as Federation, yt as ActorKeyPairsDispatcher, z as TaskDefinition, zt as SharedInboxKeyDispatcher } from "./context-b36TpPoG.cjs";
+import { $ as MessageQueue, A as ObjectCallbackSetters, At as InboxListener, B as TaskDefinitionOptions, Bt as SharedInboxKeyDispatcher, C as FederationOptions, Ct as CollectionDispatcher, D as InboxChallengePolicy, Dt as HashlinkMediaDispatcher, E as IdempotencyStrategy, Et as CustomCollectionDispatcher, F as FederationQueueOptions, Ft as OutboxErrorHandler, G as RetryContext, Gt as SenderKeyPair, H as TaskHandler, Ht as UnverifiedActivityReason, I as createFederation, It as OutboxListener, J as RespondWithObjectOptions, Jt as digest, K as RetryPolicy, Kt as PageItems, L as Message, Lt as OutboxListenerErrorHandler, M as Rfc6570Expression, Mt as NodeInfoDispatcher, N as FederationKvPrefixes, Nt as ObjectAuthorizePredicate, O as InboxListenerSetters, Ot as HashlinkMediaRequest, P as FederationOrigin, Pt as ObjectDispatcher, Q as InProcessMessageQueueOptions, R as createFederationBuilder, Rt as OutboxPermanentFailureHandler, S as FederationFetchOptions, St as CollectionCursor, T as IdempotencyKeyCallback, Tt as CustomCollectionCursor, U as TaskRegistry, Ut as WebFingerLinksDispatcher, V as TaskEnqueueOptions, Vt as UnverifiedActivityHandler, W as CreateExponentialBackoffPolicyOptions, Wt as SendActivityError, X as respondWithObjectIfAcceptable, Y as respondWithObject, Yt as ActivityTransformer, Z as InProcessMessageQueue, _ as CustomCollectionCallbackSetters, _t as ActorDispatcher, a as GetSignedKeyOptions, at as CircuitBreakerActivityDrop, b as FederationBenchmarkOptions, bt as AuthorizePredicate, c as ParseUriResult, ct as CircuitBreakerFailurePolicy, d as RouteActivityOptions, dt as CircuitBreakerState, et as MessageQueueDepth, f as SendActivityOptions, ft as CircuitBreakerStateChange, g as ConstructorWithTypeId, gt as ActorAliasMapper, h as CollectionCallbackSetters, ht as parseCircuitBreakerKvState, i as GetActorOptions, it as CircuitBreaker, j as OutboxListenerSetters, jt as MediaUploaderCallback, k as MediaUploaderSetters, kt as InboxErrorHandler, l as PortableRequest, lt as CircuitBreakerKvState, m as ActorCallbackSetters, mt as normalizeCircuitBreakerOptions, n as Context, nt as MessageQueueListenOptions, o as InboxContext, ot as CircuitBreakerBeforeSendDecision, p as SendActivityOptionsForCollection, pt as NormalizedCircuitBreakerOptions, q as createExponentialBackoffPolicy, qt as buildCollectionSynchronizationHeader, r as ForwardActivityOptions, rt as ParallelMessageQueue, s as OutboxContext, st as CircuitBreakerCreateOptions, t as ActorKeyPair, tt as MessageQueueEnqueueOptions, u as RequestContext, ut as CircuitBreakerOptions, v as Federatable, vt as ActorHandleMapper, w as FederationStartQueueOptions, wt as CustomCollectionCounter, x as FederationBuilder, xt as CollectionCounter, y as Federation, yt as ActorKeyPairsDispatcher, z as TaskDefinition, zt as PortableActorIdMapper } from "./context-DijrgHDe.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-Bfenkg_c.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-pLbeNwcC.cjs";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CyiSjRkk.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-DTAaBwiY.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-HDSvS-ww.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-xGFCHqq_.cjs";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts
 declare namespace mod_d_exports {
-  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableActorIdMapper, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
 }
 //#endregion
-export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableActorIdMapper, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };