@fedify/fedify 2.4.0-dev.2065 → 2.4.0-dev.2073

package/dist/{middleware-s-AZzx4r.mjs → middleware-CpyCNOW_.mjs}

@@ -1,27 +1,27 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BuRFI7wk.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DOqknlZd.mjs";
+import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DvlvYpq_.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-BxHsA1s9.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-f1qaBtOh.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-_aSNLA90.mjs";
-import { n as kvCache } from "./kv-cache-C9IY-FMN.mjs";
+import { d as hasPortableActor, f as isCompatibleKeyId, m as isPortableUri, o as importJwk, s as validateCryptoKey, t as exportJwk, u as getGatewayKeyBase } from "./key-BYXnTGro.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DT3e2hOv.mjs";
+import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-CxsVG6vM.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-C7qHlv-b.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-C0SWQylk.mjs";
+import { n as kvCache } from "./kv-cache-DEH5jyND.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CqJq5erX.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-D_F22lfM.mjs";
-import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-B03JXhrk.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-NNkfKtVN.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CMkrnYbY.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CDsVeZI7.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BZJ7NsVV.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CVHpPAjK.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-Dj3DCsoj.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-B5Skp-vE.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-VVVSuruq.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CLzSfIOV.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -1467,7 +1467,7 @@ async function handleInbox(request, options) {
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInboxInternal(request, parameters, span) {
-	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
+	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -1480,7 +1480,7 @@ async function handleInboxInternal(request, parameters, span) {
 			message: "Actor dispatcher is not set."
 		});
 		return await onNotFound(request);
-	} else if (recipient != null) {
+	} else if (recipient != null && portableInbox == null) {
 		const actor = await actorDispatcher(ctx, recipient);
 		if (actor == null || actor instanceof Tombstone) {
 			logger.error("Actor {recipient} not found.", { recipient });
@@ -1653,6 +1653,7 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let activity = null;
 	let activityVerified = false;
+	let proofVerified = false;
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -1669,6 +1670,21 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		if (!skipSignatureVerification && hasPortableActor(activity)) try {
+			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			}) != null;
+		} catch (error) {
+			if (!isPermanentActivityParseError(error)) throw error;
+			logger.debug("Failed to verify the Object Integrity Proofs of the portable actor's activity:\n{error}", {
+				recipient,
+				error
+			});
+		}
 	} else {
 		logger.debug("Linked Data Signatures are not verified.", {
 			recipient,
@@ -1725,6 +1741,7 @@ async function handleInboxInternal(request, parameters, span) {
 				activity: json
 			});
 			activityVerified = true;
+			proofVerified = true;
 		}
 	}
 	let httpSigKey = null;
@@ -1837,6 +1854,24 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
+	if (!skipSignatureVerification && !proofVerified && (hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
+			activity: json,
+			recipient,
+			activityId: activity.id?.href,
+			actorId: activity.actorId?.href,
+			keyId: httpSigKey?.id?.href
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity of the portable actor (${activity.actorId?.href}) is not authenticated by a valid Object Integrity Proof.`
+		});
+		return new Response("Activities of portable actors must have valid Object Integrity Proofs.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
@@ -1907,6 +1942,19 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		idempotencyStrategy: parameters.idempotencyStrategy
 	});
+	if (portableInbox != null && activity.id != null && PORTABLE_INBOX_FORWARDABLE_RESULTS.has(routeResult)) if (skipSignatureVerification || !(ldSigVerified || proofVerified)) logger.debug("Not forwarding activity {activityId} to the other gateways of the portable inbox {inbox}, as it is not authenticated by its own proof.", {
+		activityId: activity.id.href,
+		inbox: portableInbox.recipient.canonicalInboxId
+	});
+	else try {
+		await portableInbox.forward(json, activity.id, getTypeId(activity).href);
+	} catch (error) {
+		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
+			activityId: activity.id.href,
+			inbox: portableInbox.recipient.canonicalInboxId,
+			error
+		});
+	}
 	if (routeResult === "alreadyProcessed") return new Response(`Activity <${activity.id}> has already been processed.`, {
 		status: 202,
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -1932,6 +1980,12 @@ async function handleInboxInternal(request, parameters, span) {
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
 }
+const PORTABLE_INBOX_FORWARDABLE_RESULTS = /* @__PURE__ */ new Set([
+	"success",
+	"enqueued",
+	"alreadyProcessed",
+	"unsupportedActivity"
+]);
 /**
 * Handles a custom collection request.
 * @template TItem The type of items in the collection.
@@ -2539,6 +2593,260 @@ const MIN_COMPONENTS = [
 	"@target-uri",
 	"@authority"
 ];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableUri(key.ownerId);
+}
+//#endregion
+//#region src/federation/portable-inbox.ts
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	if (id == null || id.protocol !== "ap:" && id.protocol !== "ap+ef61:") return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (!isSameAuthority(id, authority)) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId;
+	if (inboxId == null || canonicalize(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+function isSameAuthority(id, authority) {
+	try {
+		return getFe34Origin(id) === authority;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function canonicalize(iri) {
+	try {
+		return canonicalizePortableUri(typeof iri === "string" ? iri : formatIri(iri));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are not signed with HTTP Signatures; the receiving
+* gateways authenticate the activity by its own proof.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
+	if (kv.cas == null || maxTargets < 1) return [];
+	const canonicalActivityId = canonicalize(activityId) ?? activityId.href;
+	const targets = getForwardingTargets(recipient, excludedOrigins);
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) {
+		const key = [
+			...kvPrefix,
+			recipient.canonicalInboxId,
+			canonicalActivityId,
+			gateway
+		];
+		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
+	}
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+async function forwardImmediately({ activity, activityId, activityType, allowPrivateAddress, options, meterProvider, tracerProvider }, inboxes) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
+	const sends = inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: [],
+		inbox,
+		allowPrivateAddress,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}));
+	let timer;
+	const timedOut = await Promise.race([Promise.all(sends).then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding({ activity, activityId, activityType, baseUrl, startQueue, meterProvider }, outboxQueue, inboxes) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	propagation.inject(context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys: [],
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
 //#endregion
 //#region src/federation/outgoing-proof.ts
 function isPortableUrl(url) {
@@ -2548,37 +2856,48 @@ function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
+* Rejects an activity of a portable actor whose ID cannot be authenticated by
+* the actor's DID: FEP-ef61 requires the activity to be a portable object
+* signed by that DID, so its ID has to be a portable ID with the same DID.
+* @throws {TypeError} If the activity is performed by a portable actor, but
+*                     its ID is not a portable ID of the actor's DID, or its
+*                     portable actors do not share a DID.
+* @internal
+*/
+function assertPortableActorActivity(activity) {
+	const portableActors = activity.actorIds.filter(isPortableUrl);
+	if (portableActors.length < 1) return;
+	const did = getFe34Origin(portableActors[0]);
+	if (portableActors.some((actorId) => getFe34Origin(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !isPortableUrl(activity.id) || getFe34Origin(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+}
+/**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
+* Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
+* never sign proofs.  A portable activity, i.e., one with an `ap:` or
+* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* whose verification method is a DID URL for its DID, even if it is the only
+* key; if no key or more than one key qualifies, this function throws.
+*
 * Outside the map-local compound-proof profile, i.e., when the activity
 * embeds no portable object, every Ed25519 key signs the activity, as it
 * always has.  Inside the profile, which accepts exactly one direct proof per
 * map, Fedify creates at most one proof:
 *
 *  -  An activity that already carries a proof is kept as is.
-*  -  A single Ed25519 key signs the activity.
-*  -  With several Ed25519 keys, a portable activity is signed by the one key
-*     whose verification method is a DID URL for the activity's DID, the only
-*     proof the FEP-ef61 policy can accept.  If no key or more than one key
-*     qualifies, or the activity is not portable itself, the choice is
-*     ambiguous and this function throws.
+*  -  A single Ed25519 key signs a non-portable activity.
+*  -  With several Ed25519 keys, a non-portable activity is ambiguous, and
+*     this function throws.
 *
-* @throws {TypeError} If a single proof key cannot be chosen.
+* @throws {TypeError} If a single proof key cannot be chosen, or the activity
+*                     is performed by a portable actor but is not a portable
+*                     activity of the same DID.
 * @internal
 */
 async function signOutgoingActivity(activity, candidates, options) {
 	const { contextLoader, tracerProvider } = options;
-	let hasProof = false;
-	for await (const _ of activity.getProofs({ contextLoader })) {
-		hasProof = true;
-		break;
-	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519");
-	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
-		activity,
-		hasProof,
-		proofCreated: false
-	};
+	assertPortableActorActivity(activity);
 	const sign = async (selected) => {
 		for (const { verificationMethod, privateKey } of selected) activity = await signObject(activity, privateKey, verificationMethod, {
 			contextLoader,
@@ -2590,6 +2909,18 @@ async function signOutgoingActivity(activity, candidates, options) {
 			proofCreated: true
 		};
 	};
+	let hasProof = false;
+	for await (const _ of activity.getProofs({ contextLoader })) {
+		hasProof = true;
+		break;
+	}
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
+		activity,
+		hasProof,
+		proofCreated: false
+	};
 	if (keys.length < 2 && !hasProof) return await sign(keys);
 	if (!containsCompoundPortableObject(await activity.toJsonLd({
 		format: "compact",
@@ -2609,15 +2940,26 @@ async function signOutgoingActivity(activity, candidates, options) {
 			proofCreated: false
 		};
 	}
-	if (activity.id == null || !isPortableUrl(activity.id)) throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
-	const activityDid = getFe34Origin(activity.id);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && haveSameFe34Origin(activity.id, c.verificationMethod));
-	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  The map-local compound-proof profile accepts exactly one direct proof per map, and FEP-ef61 requires that proof's verification method to be a DID URL for the activity's DID.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
-	logger.debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID; the map-local compound-proof profile accepts exactly one direct proof per map.", {
-		activityId,
+	throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
+}
+/**
+* Chooses the one Ed25519 key that can sign a portable activity: the key
+* whose verification method is a DID URL for the activity's DID.
+* @throws {TypeError} If no key or more than one key qualifies.
+*/
+function selectPortableActivityKey(activity, activityId, keys) {
+	const activityDid = getFe34Origin(activityId);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && haveSameFe34Origin(activityId, c.verificationMethod));
+	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
+	getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]).debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID.", {
+		activityId: activity.id?.href,
 		keyId: eligible[0].verificationMethod.href
 	});
-	return await sign(eligible);
+	return eligible;
 }
 /**
 * Rejects an outgoing activity whose proofs Fedify's own inbox would reject
@@ -3226,6 +3568,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	kvPrefixes;
 	publicKeyTtl;
 	httpMessageSignaturesSpecTtl;
+	portableInboxForwarding;
 	inboxQueue;
 	outboxQueue;
 	fanoutQueue;
@@ -3258,6 +3601,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	benchmarkMetricReader;
 	benchmarkTriggerOptions;
 	#mediaUploaderNoAuthWarned = false;
+	#portableInboxForwardingWarned = false;
 	#queueDepthGaugeSourceId = `fedify-${(++nextQueueDepthGaugeSourceId).toString(36)}`;
 	#queueDepthGaugeEntries = [];
 	#queueDepthGaugeMeterProvider;
@@ -3289,10 +3633,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"],
 			circuitBreaker: ["_fedify", "circuit"],
 			taskDeduplication: ["_fedify", "taskDeduplication"],
+			portableInboxForwarding: ["_fedify", "portableInboxForwarding"],
 			...options.kvPrefixes ?? {}
 		};
 		this.publicKeyTtl = Temporal.Duration.from(options.publicKeyTtl ?? { days: 30 });
 		this.httpMessageSignaturesSpecTtl = Temporal.Duration.from(options.httpMessageSignaturesSpecTtl ?? { days: 90 });
+		this.portableInboxForwarding = resolvePortableInboxForwardingOptions(options.portableInboxForwarding);
 		if (options.queue == null) {
 			this.inboxQueue = void 0;
 			this.outboxQueue = void 0;
@@ -3962,8 +4308,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		]);
 		const baseUrl = new URL(message.baseUrl);
 		let context = this.#createContext(baseUrl, ctxData);
-		if (message.identifier != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
-		else if (this.sharedInboxKeyDispatcher != null) {
+		if (message.identifier != null && this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
+		else if (message.identifier == null && this.sharedInboxKeyDispatcher != null) {
 			const identity = await this.sharedInboxKeyDispatcher(context);
 			if (identity != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 		}
@@ -4322,9 +4668,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const contextLoader = this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
 		const activityId = activity.id.href;
 		let rsaKey = null;
+		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
@@ -4345,7 +4692,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		});
 		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
 		assertSupportedCompoundProofShape(jsonLd, activityId);
-		if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		if (rsaKey == null && !ldSignable) logger.debug("The activity {activityId} is performed by a portable actor, so it is sent without a Linked Data signature.", { activityId });
+		else if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
 			keys: keys.map((pair) => ({
 				keyId: pair.keyId.href,
@@ -4554,6 +4902,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 				span,
 				metricState
 			});
+			if (request.method === "POST") {
+				const portable = parsePortableGatewayRequest(url);
+				if (portable != null) return await this.#fetchPortableInbox(request, portable, {
+					onNotFound,
+					contextData,
+					span,
+					metricState
+				});
+			}
 			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
 			if (portable != null) return await discardBodyForHead(request, await this.#fetchPortableObject(request, portable, {
 				onNotFound,
@@ -4705,35 +5062,17 @@ var FederationImpl = class extends FederationBuilderImpl {
 					onNotFound
 				});
 				context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: route.values.identifier }) });
-			case "sharedInbox": {
+			case "sharedInbox":
 				if (routeName !== "inbox" && this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
-				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
-				const inboxContextFactory = context.toInboxContext.bind(context);
-				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
-				return await handleInbox(request, {
+				return await this.#handleInbox(request, {
 					recipient: route.values.identifier ?? null,
 					context,
-					inboxContextFactory,
-					kv: this.kv,
-					kvPrefixes: this.kvPrefixes,
-					publicKeyTtl: this.publicKeyTtl,
-					queue: this.inboxQueue,
-					actorDispatcher: this.actorCallbacks?.dispatcher,
-					inboxListeners: this.inboxListeners,
-					inboxErrorHandler: this.inboxErrorHandler,
-					unverifiedActivityHandler: this.unverifiedActivityHandler,
-					onNotFound,
-					signatureTimeWindow: this.signatureTimeWindow,
-					skipSignatureVerification: this.skipSignatureVerification,
-					inboxChallengePolicy: this.inboxChallengePolicy,
-					meterProvider: this.meterProvider,
-					tracerProvider: this.tracerProvider,
-					idempotencyStrategy: this.idempotencyStrategy
+					contextData,
+					onNotFound
 				});
-			}
 			case "following": return await handleCollection(request, {
 				name: "following",
 				identifier: route.values.identifier,
@@ -4886,6 +5225,113 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound
 		});
 	}
+	async #handleInbox(request, { recipient, context, contextData, onNotFound, portableInbox }) {
+		if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+		const inboxContextFactory = context.toInboxContext.bind(context);
+		inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
+		return await handleInbox(request, {
+			recipient,
+			context,
+			inboxContextFactory,
+			kv: this.kv,
+			kvPrefixes: this.kvPrefixes,
+			publicKeyTtl: this.publicKeyTtl,
+			queue: this.inboxQueue,
+			actorDispatcher: this.actorCallbacks?.dispatcher,
+			inboxListeners: this.inboxListeners,
+			inboxErrorHandler: this.inboxErrorHandler,
+			unverifiedActivityHandler: this.unverifiedActivityHandler,
+			onNotFound,
+			signatureTimeWindow: this.signatureTimeWindow,
+			skipSignatureVerification: this.skipSignatureVerification,
+			inboxChallengePolicy: this.inboxChallengePolicy,
+			meterProvider: this.meterProvider,
+			tracerProvider: this.tracerProvider,
+			idempotencyStrategy: this.idempotencyStrategy,
+			portableInbox
+		});
+	}
+	async #fetchPortableInbox(request, portable, { onNotFound, contextData, span, metricState }) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			logger.debug("Malformed FEP-ef61 gateway inbox request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response("Malformed portable inbox ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		if (route == null || route.name !== "inbox") {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = "inbox";
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		const identifier = route.values.identifier;
+		let context = this.#createContext(request, contextData);
+		const actor = this.actorCallbacks?.dispatcher == null ? null : await this.actorCallbacks.dispatcher(context, identifier);
+		const localOrigin = context.canonicalOrigin;
+		const resolution = resolvePortableInboxRecipient(actor == null || actor instanceof Tombstone ? null : actor, {
+			authority: portable.portableRequest.authority,
+			canonicalInboxId: portable.canonicalId,
+			localOrigin
+		});
+		if (resolution.status === "rejected") {
+			logger.debug("Not accepting a delivery to the portable inbox {inbox} on behalf of the actor {identifier}: {reason}.", {
+				inbox: portable.canonicalId,
+				identifier,
+				reason: resolution.reason
+			});
+			return await onNotFound(request);
+		}
+		const { recipient } = resolution;
+		if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier }) });
+		const excludedOrigins = [localOrigin, new URL(request.url).origin];
+		return await this.#handleInbox(request, {
+			recipient: identifier,
+			context,
+			contextData,
+			onNotFound,
+			portableInbox: {
+				recipient,
+				forward: async (activity, activityId, activityType) => {
+					if (this.portableInboxForwarding.maxTargets < 1) return;
+					if (this.kv.cas == null) {
+						if (!this.#portableInboxForwardingWarned) {
+							this.#portableInboxForwardingWarned = true;
+							logger.warn("Activities delivered to FEP-ef61 portable inboxes are not forwarded to the other gateways, as the key–value store does not support compare-and-swap (KvStore.cas()), which is needed to forward each activity at most once.");
+						}
+						return;
+					}
+					await forwardPortableInboxActivity({
+						recipient,
+						activity,
+						activityId,
+						activityType,
+						excludedOrigins,
+						baseUrl: context.origin,
+						kv: this.kv,
+						kvPrefix: this.kvPrefixes.portableInboxForwarding,
+						outboxQueue: this.outboxQueue,
+						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
+						allowPrivateAddress: this.allowPrivateAddress,
+						options: this.portableInboxForwarding,
+						meterProvider: this.meterProvider,
+						tracerProvider: this.tracerProvider
+					});
+				}
+			}
+		});
+	}
 	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
 		metricState.endpoint = "hashlink_media";
 		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;
@@ -5116,6 +5562,12 @@ var ContextImpl = class ContextImpl {
 		if (path == null) throw new RouterError("No inbox path registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
+	getPortableInboxUri(identifier, authority) {
+		const path = this.federation.router.build("inbox", { identifier });
+		if (path == null) throw new RouterError("No inbox path registered.");
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
 	getFollowingUri(identifier) {
 		const path = this.federation.router.build("following", { identifier });
 		if (path == null) throw new RouterError("No following collection path registered.");
@@ -5221,14 +5673,15 @@ var ContextImpl = class ContextImpl {
 			getActorKeyPairsIdentifier: identifier,
 			actorKeyPairsDispatcherIdentifier: this.invokedFromActorKeyPairsDispatcher.identifier
 		});
+		const portableActor = await this.getPortableActorKeyOwner(identifier);
 		let keyPairs;
 		try {
-			keyPairs = await this.getKeyPairsFromIdentifier(identifier);
+			keyPairs = await this.getKeyPairsFromIdentifier(identifier, portableActor);
 		} catch (_) {
 			logger.warn("No actor key pairs dispatcher registered.");
 			return [];
 		}
-		const owner = this.getActorUri(identifier);
+		const owner = portableActor?.id ?? this.getActorUri(identifier);
 		const result = [];
 		let i = 1;
 		for (const keyPair of keyPairs) {
@@ -5240,7 +5693,7 @@ var ContextImpl = class ContextImpl {
 					publicKey: keyPair.publicKey
 				}),
 				multikey: new Multikey({
-					id: new URL(`#multikey-${i}`, owner),
+					id: portableActor == null ? new URL(`#multikey-${i}`, owner) : keyPair.keyId,
 					controller: owner,
 					publicKey: keyPair.publicKey
 				})
@@ -5250,7 +5703,26 @@ var ContextImpl = class ContextImpl {
 		}
 		return result;
 	}
-	async getKeyPairsFromIdentifier(identifier) {
+	/**
+	* Resolves the portable actor that the actor with the given identifier is,
+	* through the portable actor ID mapper, along with the base of its gateway
+	* key IDs on this server.
+	* @param identifier The actor's identifier.
+	* @returns The portable actor's ID and key ID base, or `null` if the actor
+	*          is not portable.
+	* @throws {TypeError} If the mapper returns an invalid portable actor ID.
+	*/
+	async getPortableActorKeyOwner(identifier) {
+		const mapper = this.federation.actorCallbacks?.portableActorIdMapper;
+		if (mapper == null) return null;
+		const id = await mapper(this, identifier);
+		if (id == null) return null;
+		return {
+			id,
+			keyBase: getGatewayKeyBase(id, this.canonicalOrigin)
+		};
+	}
+	async getKeyPairsFromIdentifier(identifier, portableActor) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
@@ -5267,6 +5739,8 @@ var ContextImpl = class ContextImpl {
 			}
 			throw error;
 		}
+		if (portableActor === void 0) portableActor = await this.getPortableActorKeyOwner(identifier);
+		const keyBase = portableActor?.keyBase ?? actorUri;
 		const keyPairs = await this.federation.actorCallbacks?.keyPairsDispatcher(new ContextImpl({
 			...this,
 			invokedFromActorKeyPairsDispatcher: { identifier }
@@ -5277,7 +5751,7 @@ var ContextImpl = class ContextImpl {
 		for (const keyPair of keyPairs) {
 			result.push({
 				...keyPair,
-				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, actorUri)
+				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, keyBase)
 			});
 			i++;
 		}
@@ -5696,6 +6170,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	getPortableObjectUri(cls, values, authority) {
 		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
 	}
+	getPortableInboxUri(identifier, authority) {
+		return super.getPortableInboxUri(identifier, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) getLogger([
@@ -6086,4 +6563,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { autoIdAssigner as S, parseHashlinkGatewayRequest as _, OutboxContextImpl as a, handleNodeInfoJrd as b, handleActor as c, handleInbox as d, handleObject as f, PORTABLE_OBJECT_CONTENT_TYPE as g, respondWithObjectIfAcceptable as h, KvSpecDeterminer as i, handleCollection as l, respondWithObject as m, FederationImpl as n, createFederation as o, handleOutbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCustomCollection as u, handleBenchmarkTrigger as v, actorDehydrator as x, handleNodeInfo as y };
+export { actorDehydrator as C, handleNodeInfoJrd as S, respondWithObjectIfAcceptable as _, OutboxContextImpl as a, handleBenchmarkTrigger as b, forwardPortableInboxActivity as c, handleCollection as d, handleCustomCollection as f, respondWithObject as g, handleOutbox as h, KvSpecDeterminer as i, resolvePortableInboxForwardingOptions as l, handleObject as m, FederationImpl as n, createFederation as o, handleInbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleActor as u, PORTABLE_OBJECT_CONTENT_TYPE as v, autoIdAssigner as w, handleNodeInfo as x, parseHashlinkGatewayRequest as y };